Merge pull request 'fix: [nomad-step-5] edge dispatcher task: Missing vault.read(kv/data/disinto/bots/vault) on fresh init (#1035)' (#1041) from fix/issue-1035 into main

.woodpecker/detect-duplicates.py

@@ -308,6 +308,21 @@ def main() -> int:
         "63bfa88d71764c95c65a9a248f3e40ab": "Vault-seed preconditions: binary check end + VAULT_ADDR die",
         "34873ad3570b211ce1d90468ab6ac94c": "Vault-seed preconditions: VAULT_ADDR die + hvault_token_lookup",
         "71a52270f249e843cda48ad896d9f781": "Vault-seed preconditions: VAULT_ADDR + hvault_token_lookup + die",
+        # Common vault-seed script flag parsing patterns
+        # Shared across tools/vault-seed-{forgejo,ops-repo}.sh
+        "6906b7787796c2ccb8dd622e2ad4e7bf": "vault-seed DRY_RUN init + case pattern (forgejo + ops-repo)",
+        "a0df5283b616b964f8bc32fd99ec1b5a": "vault-seed case pattern start (forgejo + ops-repo)",
+        "e15e3272fdd9f0f46ce9e726aea9f853": "vault-seed case pattern dry-run handler (forgejo + ops-repo)",
+        "c9f22385cc49a3dac1d336bc14c6315b": "vault-seed DRY_RUN assignment (forgejo + ops-repo)",
+        "106f4071e88f841b3208b01144cd1c39": "vault-seed case pattern dry-run end (forgejo + ops-repo)",
+        "c15506dcb6bb340b25d1c39d442dd2e6": "vault-seed help text + invalid arg handler (forgejo + ops-repo)",
+        "1feecd3b3caf00045fae938ddf2811de": "vault-seed invalid arg handler (forgejo + ops-repo)",
+        "919780d5e7182715344f5aa02b191294": "vault-seed invalid arg + esac pattern (forgejo + ops-repo)",
+        "8dce1d292bce8e60ef4c0665b62945b0": "vault-seed esac + binary check loop (forgejo + ops-repo)",
+        "ca043687143a5b47bd54e65a99ce8ee8": "vault-seed binary check loop start (forgejo + ops-repo)",
+        "aefd9f655411a955395e6e5995ddbe6f": "vault-seed binary check pattern (forgejo + ops-repo)",
+        "60f0c46deb5491599457efb4048918e5": "vault-seed VAULT_ADDR + hvault_token_lookup check (forgejo + ops-repo)",
+        "f6838f581ef6b4d82b55268389032769": "vault-seed VAULT_ADDR + hvault_token_lookup die (forgejo + ops-repo)",
     }
 
     if not sh_files:

bin/disinto

@@ -802,6 +802,7 @@ _disinto_init_nomad() {
           woodpecker-server|woodpecker-agent) seed_name="woodpecker" ;;
           agents) seed_name="agents" ;;
           chat) seed_name="chat" ;;
+          edge) seed_name="ops-repo" ;;
         esac
         local seed_script="${FACTORY_ROOT}/tools/vault-seed-${seed_name}.sh"
         if [ -x "$seed_script" ]; then
@@ -983,6 +984,7 @@ _disinto_init_nomad() {
         woodpecker-server|woodpecker-agent) seed_name="woodpecker" ;;
         agents) seed_name="agents" ;;
         chat) seed_name="chat" ;;
+        edge) seed_name="ops-repo" ;;
       esac
       local seed_script="${FACTORY_ROOT}/tools/vault-seed-${seed_name}.sh"
       if [ -x "$seed_script" ]; then

nomad/jobs/edge.hcl

@@ -248,10 +248,10 @@ EOT
         change_mode          = "restart"
         error_on_missing_key = false
         data                 = <<EOT
-{{- with secret "kv/data/disinto/bots/vault" -}}
+{{- with secret "kv/data/disinto/shared/ops-repo" -}}
 FORGE_TOKEN={{ .Data.data.token }}
 {{- else -}}
-# WARNING: kv/disinto/bots/vault is empty — run tools/vault-seed-agents.sh
+# WARNING: kv/disinto/shared/ops-repo is empty — run tools/vault-seed-ops-repo.sh
 FORGE_TOKEN=seed-me
 {{- end }}
 EOT

tests/disinto-init-nomad.bats

@@ -426,3 +426,19 @@ setup_file() {
   [[ "$output" == *"services to deploy: forgejo,woodpecker-server,woodpecker-agent,agents"* ]]
   [[ "$output" == *"deployment order: forgejo woodpecker-server woodpecker-agent agents"* ]]
 }
+
+# S5.1 / #1035 — edge service seeds ops-repo (dispatcher FORGE_TOKEN)
+@test "disinto init --backend=nomad --with edge deploys edge" {
+  run "$DISINTO_BIN" init placeholder/repo --backend=nomad --with edge --dry-run
+  [ "$status" -eq 0 ]
+  # edge depends on all backend services, so all are included
+  [[ "$output" == *"services to deploy: edge,forgejo"* ]]
+  [[ "$output" == *"deployment order: forgejo woodpecker-server woodpecker-agent agents staging chat edge"* ]]
+  [[ "$output" == *"[deploy] [dry-run] nomad job validate"*"edge.hcl"* ]]
+}
+
+@test "disinto init --backend=nomad --with edge seeds ops-repo" {
+  run "$DISINTO_BIN" init placeholder/repo --backend=nomad --with edge --dry-run
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"tools/vault-seed-ops-repo.sh --dry-run"* ]]
+}

tools/vault-seed-ops-repo.sh

@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+# =============================================================================
+# tools/vault-seed-ops-repo.sh — Idempotent seed for kv/disinto/shared/ops-repo
+#
+# Part of the Nomad+Vault migration (S5.1, issue #1035). Populates the KV v2
+# path that nomad/jobs/edge.hcl dispatcher task reads from, so the edge
+# proxy has FORGE_TOKEN for ops repo access.
+#
+# Seeds from kv/disinto/bots/vault (the vault bot credentials) — copies the
+# token field to kv/disinto/shared/ops-repo. This is the "service" path that
+# dispatcher uses, distinct from the "agent" path (bots/vault) used by
+# agent tasks under the service-agents policy.
+#
+# Idempotency contract:
+#   - Key present with non-empty value → leave untouched, log "token unchanged".
+#   - Key missing or empty → copy from bots/vault, log "token copied".
+#   - If bots/vault is also empty → generate a random value, log "token generated".
+#
+# Preconditions:
+#   - Vault reachable + unsealed at $VAULT_ADDR.
+#   - VAULT_TOKEN set (env) or /etc/vault.d/root.token readable.
+#   - The `kv/` mount is enabled as KV v2.
+#
+# Requires:
+#   - VAULT_ADDR  (e.g. http://127.0.0.1:8200)
+#   - VAULT_TOKEN (env OR /etc/vault.d/root.token, resolved by lib/hvault.sh)
+#   - curl, jq, openssl
+#
+# Usage:
+#   tools/vault-seed-ops-repo.sh
+#   tools/vault-seed-ops-repo.sh --dry-run
+#
+# Exit codes:
+#   0  success (seed applied, or already applied)
+#   1  precondition / API / mount-mismatch failure
+# =============================================================================
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+
+# shellcheck source=../lib/hvault.sh
+source "${REPO_ROOT}/lib/hvault.sh"
+
+# KV v2 mount + logical paths
+KV_MOUNT="kv"
+OPS_REPO_PATH="disinto/shared/ops-repo"
+VAULT_BOT_PATH="disinto/bots/vault"
+
+OPS_REPO_API="${KV_MOUNT}/data/${OPS_REPO_PATH}"
+VAULT_BOT_API="${KV_MOUNT}/data/${VAULT_BOT_PATH}"
+
+log() { printf '[vault-seed-ops-repo] %s\n' "$*"; }
+die() { printf '[vault-seed-ops-repo] ERROR: %s\n' "$*" >&2; exit 1; }
+
+# ── Flag parsing ─────────────────────────────────────────────────────────────
+DRY_RUN=0
+case "$#:${1-}" in
+  0:)
+    ;;
+  1:--dry-run)
+    DRY_RUN=1
+    ;;
+  1:-h|1:--help)
+    printf 'Usage: %s [--dry-run]\n\n' "$(basename "$0")"
+    printf 'Seed kv/disinto/shared/ops-repo with FORGE_TOKEN.\n\n'
+    printf 'Copies token from kv/disinto/bots/vault if present;\n'
+    printf 'otherwise generates a random value. Idempotent:\n'
+    printf 'existing non-empty values are left untouched.\n\n'
+    printf '  --dry-run   Print planned actions without writing.\n'
+    exit 0
+    ;;
+  *)
+    die "invalid arguments: $*  (try --help)"
+    ;;
+esac
+
+# ── Preconditions ────────────────────────────────────────────────────────────
+for bin in curl jq openssl; do
+  command -v "$bin" >/dev/null 2>&1 \
+    || die "required binary not found: ${bin}"
+done
+
+[ -n "${VAULT_ADDR:-}" ] \
+  || die "VAULT_ADDR unset — e.g. export VAULT_ADDR=http://127.0.0.1:8200"
+hvault_token_lookup >/dev/null \
+  || die "Vault auth probe failed — check VAULT_ADDR + VAULT_TOKEN"
+
+# ── Step 1/2: ensure kv/ mount exists and is KV v2 ───────────────────────────
+log "── Step 1/2: ensure ${KV_MOUNT}/ is KV v2 ──"
+export DRY_RUN
+hvault_ensure_kv_v2 "$KV_MOUNT" "[vault-seed-ops-repo]" \
+  || die "KV mount check failed"
+
+# ── Step 2/2: seed ops-repo from vault bot ───────────────────────────────────
+log "── Step 2/2: seed ${OPS_REPO_API} ──"
+
+# Read existing ops-repo value
+existing_raw="$(hvault_get_or_empty "${OPS_REPO_API}")" \
+  || die "failed to read ${OPS_REPO_API}"
+
+existing_token=""
+if [ -n "$existing_raw" ]; then
+  existing_token="$(printf '%s' "$existing_raw" | jq -r '.data.data.token // ""')"
+fi
+
+desired_token="$existing_token"
+action=""
+
+if [ -z "$existing_token" ]; then
+  # Token missing — try to copy from vault bot
+  bot_raw="$(hvault_get_or_empty "${VAULT_BOT_API}")" || true
+  if [ -n "$bot_raw" ]; then
+    bot_token="$(printf '%s' "$bot_raw" | jq -r '.data.data.token // ""')"
+    if [ -n "$bot_token" ]; then
+      desired_token="$bot_token"
+      action="copied"
+    fi
+  fi
+
+  # If still no token, generate one
+  if [ -z "$desired_token" ]; then
+    if [ "$DRY_RUN" -eq 1 ]; then
+      action="generated (dry-run)"
+    else
+      desired_token="$(openssl rand -hex 32)"
+      action="generated"
+    fi
+  fi
+fi
+
+if [ -z "$action" ]; then
+  log "all keys present at ${OPS_REPO_API} — no-op"
+  log "token unchanged"
+  exit 0
+fi
+
+if [ "$DRY_RUN" -eq 1 ]; then
+  log "[dry-run] ${OPS_REPO_PATH}: would ${action} token"
+  exit 0
+fi
+
+# Write the token
+payload="$(jq -n --arg t "$desired_token" '{data: {token: $t}}')"
+_hvault_request POST "${OPS_REPO_API}" "$payload" >/dev/null \
+  || die "failed to write ${OPS_REPO_API}"
+
+log "${OPS_REPO_PATH}: ${action} token"
+log "done — ${OPS_REPO_API} seeded"