[nomad-step-3] S3-fix-4 — KV key-name mismatch: wp_forgejo_client vs forgejo_client #954

New issue

Closed

opened 2026-04-17 09:48:23 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-04-17 09:48:23 +00:00

Collaborator

Step 3 verification: WP server template reads forgejo_client / forgejo_secret from KV but the seed scripts write wp_forgejo_client / wp_forgejo_secret. Currently non-fatal because WP falls back, but will break when inline env is removed.

Root cause

nomad/jobs/woodpecker-server.hcl template:

WOODPECKER_FORGEJO_CLIENT={{ .Data.data.forgejo_client }}
WOODPECKER_FORGEJO_SECRET={{ .Data.data.forgejo_secret }}

But lib/init/nomad/wp-oauth-register.sh writes to KV with keys:

wp_forgejo_client
wp_forgejo_secret

And tools/vault-import.sh imports from .env as:

WP_FORGEJO_CLIENT → kv/disinto/shared/woodpecker/wp_forgejo_client
WP_FORGEJO_SECRET → kv/disinto/shared/woodpecker/wp_forgejo_secret

Fix — pick one side

Option A (preferred): change wp-oauth-register.sh + vault-import.sh to write forgejo_client / forgejo_secret (matching the template). Shorter names, consistent with agent_secret.

Option B: change woodpecker-server.hcl template to read wp_forgejo_client / wp_forgejo_secret. Matches the source env var names but adds the wp_ prefix inconsistency.

Prefer A. Two files to change:

lib/init/nomad/wp-oauth-register.sh — where it calls vault kv put ... wp_forgejo_client=... → forgejo_client=...
tools/vault-import.sh — the WP key mapping section

Acceptance criteria

vault kv get kv/disinto/shared/woodpecker shows keys: agent_secret, forgejo_client, forgejo_secret (no wp_ prefix).
WP server template renders the values correctly (check via nomad alloc exec <wp> env | grep FORGEJO).
vault-import.sh --dry-run shows the correct destination key names.

Labels / meta

backlog + bug-report.

Step 3 verification: WP server template reads `forgejo_client` / `forgejo_secret` from KV but the seed scripts write `wp_forgejo_client` / `wp_forgejo_secret`. Currently non-fatal because WP falls back, but will break when inline env is removed. ## Root cause `nomad/jobs/woodpecker-server.hcl` template: ``` WOODPECKER_FORGEJO_CLIENT={{ .Data.data.forgejo_client }} WOODPECKER_FORGEJO_SECRET={{ .Data.data.forgejo_secret }} ``` But `lib/init/nomad/wp-oauth-register.sh` writes to KV with keys: ``` wp_forgejo_client wp_forgejo_secret ``` And `tools/vault-import.sh` imports from `.env` as: ``` WP_FORGEJO_CLIENT → kv/disinto/shared/woodpecker/wp_forgejo_client WP_FORGEJO_SECRET → kv/disinto/shared/woodpecker/wp_forgejo_secret ``` ## Fix — pick one side **Option A** (preferred): change `wp-oauth-register.sh` + `vault-import.sh` to write `forgejo_client` / `forgejo_secret` (matching the template). Shorter names, consistent with `agent_secret`. **Option B**: change `woodpecker-server.hcl` template to read `wp_forgejo_client` / `wp_forgejo_secret`. Matches the source env var names but adds the `wp_` prefix inconsistency. Prefer A. Two files to change: - `lib/init/nomad/wp-oauth-register.sh` — where it calls `vault kv put ... wp_forgejo_client=...` → `forgejo_client=...` - `tools/vault-import.sh` — the WP key mapping section ## Acceptance criteria - `vault kv get kv/disinto/shared/woodpecker` shows keys: `agent_secret`, `forgejo_client`, `forgejo_secret` (no `wp_` prefix). - WP server template renders the values correctly (check via `nomad alloc exec <wp> env | grep FORGEJO`). - `vault-import.sh --dry-run` shows the correct destination key names. ## Labels / meta - `backlog` + `bug-report`.