Trez/rinoa-docker
4
0
Fork 0
Code Issues 1 Pull Requests 8 Actions Activity

Ansible DRY fixes for Vault lookups.
Gitea Branch PR & Ansible Deployment / Check and Create PR (push) Failing after 3m6s
Details
Gitea Branch PR & Ansible Deployment / Docker Compose & Ansible Lints (push) Has been skipped
Details
Gitea Branch PR & Ansible Deployment / PR Merge (push) Failing after 9m4s
Details
Gitea Branch PR & Ansible Deployment / Ansible Configs & Docker Compose Deployment (push) Has been skipped
Details

Browse Source
This commit is contained in:
Trez.One
2025-05-20 09:06:49 -04:00
parent c804bb6dab
commit 6b37ad8ea4
37 changed files with 118 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/app-configs/gitea_gitea-sonarqube-bot_config.yaml.j2
+4 -4
View File
@@ -9,7 +9,7 @@ gitea:
# Created access token for the user that shall be used as bot account.
# User needs "Read project" permissions with access to "Pull Requests"
token:
value: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_GITEA_TOKEN'] }}"
value: "{{ vault_secrets['GITEA_SONARQUBE_BOT_GITEA_TOKEN'] }}"
# # or path to file containing the plain text secret
# file: /path/to/gitea/token
@@ -18,7 +18,7 @@ gitea:
# The bot looks for `X-Gitea-Signature` header containing the sha256 hmac hash of the plain text secret. If the header
# exists and no webhookSecret is defined here, the bot will ignore the request, because it cannot be validated.
webhook:
secret: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_GITEA_WEBHOOK_SECRET'] }}"
secret: "{{ vault_secrets['GITEA_SONARQUBE_BOT_GITEA_WEBHOOK_SECRET'] }}"
# # or path to file containing the plain text secret
# secretFile: /path/to/gitea/webhook/secret
@@ -35,7 +35,7 @@ sonarqube:
# Created access token for the user that shall be used as bot account.
# User needs "Browse on project" permissions
token:
value: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_SQUBE_TOKEN'] }}"
value: "{{ vault_secrets['GITEA_SONARQUBE_BOT_SQUBE_TOKEN'] }}"
# # or path to file containing the plain text secret
# file: /path/to/sonarqube/token
@@ -45,7 +45,7 @@ sonarqube:
# If the header exists and no webhookSecret is defined here, the bot will ignore the request, because it cannot be
# validated.
webhook:
secret: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_SQUBE_WEBHOOK_SECRET'] }}"
secret: "{{ vault_secrets['GITEA_SONARQUBE_BOT_SQUBE_WEBHOOK_SECRET'] }}"
# # or path to file containing the plain text secret
# secretFile: /path/to/sonarqube/webhook/secret