mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
ceb7e9e628
From triage of run 33923190220. Each fix is independently complete. penpot: ansible templates delegate_to before the task's merged when, and AnsibleUndefinedVariable escapes get_delegated_vars_and_hostname. PENPOT_BACKEND_HOST_NODE is set only by the resolve include, so the bootstrap task hard-failed on every host that include skipped instead of skipping with it. A block-level when cannot prevent this; move the tasks into a dynamic include. matrix: the MDAD reconfigure looked for volume matrix_matrix_mdad_state (real name matrix_mdad_state) and container matrix-mdad (real name matrix). Both if-bodies were skipped while the task still reported changed, so a rotated S3 secret never reached synapse and every media write got SignatureDoesNotMatch. Move the shell into its own script and pass the real names through the environment. Also add no_log to the vars.yml render, whose diff printed 16 secrets in cleartext. n8n: when the settings file and N8N_ENCRYPTION_KEY disagree, oclif's findCommand throws for every command, so 'n8n export:credentials' is unreachable in exactly the state that would need it. The re-key is one-way; pin it rotatable: false. swarm-drill: distros.sh sees only rc=124 and cannot tell a wedged deploy from one the sweep deadline cut short. Say so where the governor caps it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
28 lines
1.4 KiB
YAML
28 lines
1.4 KiB
YAML
---
|
|
credentials:
|
|
litellm_api_key:
|
|
description: Per-consumer virtual key for the shared svc-ai-litellm gateway
|
|
algorithm: sk_prefixed
|
|
validation:
|
|
min_length: 50
|
|
encryption_key:
|
|
description: "AES encryption key n8n uses to encrypt stored credentials at rest. Must remain stable across deploys — changing it invalidates all saved credentials.
|
|
A mismatch between the settings file and the env var makes oclif's findCommand throw for every command, so `n8n export:credentials` is unreachable in exactly
|
|
the state that would need it and a re-key is one-way."
|
|
algorithm: alphanumeric
|
|
validation: "^[A-Za-z0-9]{32,}$"
|
|
length: 48
|
|
rotatable: false
|
|
owner_password:
|
|
description: "Break-glass local password for the n8n owner account created during bootstrap. Alphanumeric on purpose — the system admin password carries special
|
|
characters (e.g. Unicode, single quotes) that fail n8n's xssCheck on the /rest/owner/setup endpoint. Normal users authenticate via SSO/Keycloak; this password
|
|
is only used for the one-time bootstrap and as a break-glass credential."
|
|
algorithm: alphanumeric
|
|
validation: "^[A-Za-z0-9]{32,}$"
|
|
length: 48
|
|
mcp_token:
|
|
description: "Bearer an MCP client must present to the managed MCP Server Trigger. Alphanumeric so it survives n8n's xssCheck on the workflow payload."
|
|
algorithm: alphanumeric
|
|
validation: "^[A-Za-z0-9]{32,}$"
|
|
length: 48
|