feat(libation): seed the token master key onto the PVC

TokenStorageMethod is Encrypted and the container has no OS secret store, so LibationCli falls back to minting a portable master key at /config-internal/libation-master.key -- a path that is not a mounted volume. The key is therefore new on every run and discarded at exit, which is why the entrypoint logs LAST-RESORT on each pass. The entrypoint looks for the key at ${LIBATION_CONFIG_DIR}/ libation-master.key, i.e. on the PVC, and copies it into place when found. The key is now stored in OpenBao alongside the other bootstrap files, so seed it like them: without it a rebuilt PVC would hold tokens encrypted under a key that no longer exists. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
fix(libation): persist refreshed Audible tokens back to the PVC
2026-09-16 18:47:24 +02:00 · 2026-09-16 18:26:49 +02:00 · 2026-09-16 15:51:49 +00:00 · 2026-09-16 17:30:37 +02:00 · 2026-09-16 12:25:51 +00:00
1 changed files with 27 additions and 4 deletions
@@ -42,9 +42,11 @@ spec:
              type: RuntimeDefault
          initContainers:
            # Seed the libation-config PVC from the bootstrap secret on
-            # first run only — sentinel file gates re-runs so token
-            # refreshes in AccountsSettings.json and DB updates from
-            # subsequent liberate passes are preserved.
+            # first run only — sentinel file gates re-runs so DB updates
+            # from subsequent liberate passes are preserved. Refreshed
+            # Audible tokens are preserved by the container args, not by
+            # this sentinel: the entrypoint copies AccountsSettings.json
+            # into ephemeral /config-internal rather than symlinking it.
            - name: seed-config
              image: busybox:1.37.0
              command: ["/bin/sh", "-eu", "-c"]
@@ -66,6 +68,11 @@ spec:
                  install -m 660 /bootstrap/AccountsSettings.json /libation-state/AccountsSettings.json
                  install -m 660 /bootstrap/Settings.json          /libation-state/Settings.json
                  install -m 660 /bootstrap/LibationContext.db     /libation-state/LibationContext.db
+                  # Without this key the seeded tokens cannot be decrypted:
+                  # TokenStorageMethod is Encrypted and the container has no
+                  # OS secret store, so a missing key file makes the
+                  # entrypoint mint a throwaway one on every run.
+                  install -m 660 /bootstrap/libation-master.key   /libation-state/libation-master.key
                  touch /libation-state/.bootstrapped
                  ls -la /libation-state
              volumeMounts:
@@ -85,7 +92,23 @@ spec:
                  type: RuntimeDefault
          containers:
            - name: libation
-              image: docker.io/rmcrackan/libation:latest
+              # Pinned by digest: Spegel caches mutable tag resolutions, so
+              # :latest stayed on 13.7.11 despite imagePullPolicy Always.
+              image: docker.io/rmcrackan/libation:14.2.1@sha256:6f9d8ba19dc3803dd6ba295ab5a7abfb6ff3bc06286eebf4ecd8ccbe43245888
+              # The entrypoint stages config into ephemeral /config-internal
+              # by copy (only the DB is symlinked to the PVC), so Audible
+              # tokens refreshed during a run are lost at container exit.
+              # Passing args makes the entrypoint set up the environment and
+              # then exec this instead of its own loop; the trap copies the
+              # refreshed file back to the PVC on every exit path.
+              args:
+                - /bin/sh
+                - -c
+                - |
+                  trap 'cp /config-internal/AccountsSettings.json /libation-state/AccountsSettings.json' EXIT
+                  set -e
+                  /libation/LibationCli scan
+                  /libation/LibationCli liberate
              env:
                - name: LIBATION_CONFIG_DIR
                  value: /libation-state
Author	SHA1	Message	Date
claude-botandClaude Opus 5	92ac021931	feat(libation): seed the token master key onto the PVC ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details TokenStorageMethod is Encrypted and the container has no OS secret store, so LibationCli falls back to minting a portable master key at /config-internal/libation-master.key -- a path that is not a mounted volume. The key is therefore new on every run and discarded at exit, which is why the entrypoint logs LAST-RESORT on each pass. The entrypoint looks for the key at ${LIBATION_CONFIG_DIR}/ libation-master.key, i.e. on the PVC, and copies it into place when found. The key is now stored in OpenBao alongside the other bootstrap files, so seed it like them: without it a rebuilt PVC would hold tokens encrypted under a key that no longer exists. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-16 18:47:24 +02:00
claude-botandClaude Opus 5	5bbca6a162	fix(libation): persist refreshed Audible tokens back to the PVC ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details The image entrypoint stages config into /config-internal, which is not a mounted volume, and it does so by copy: init_config_file() { ... cp ${FULLPATH} ${LIBATION_CONFIG_INTERNAL}/ Only LibationContext.db is symlinked to the PVC. AccountsSettings.json is therefore read from the PVC at startup and written back nowhere, so every token refresh Libation performs is discarded when the container exits. On the live PVC the file still carried its 2026-05-14 seed timestamp, four months after deployment, while the DB beside it was current. Pass args instead of letting the entrypoint run its own loop. The entrypoint completes its setup and then execs what it is given, so the staged environment is intact; an EXIT trap copies the refreshed file back to the PVC whether the run succeeds or fails. This was found while recovering from Audible refusing content licenses for this account. Re-registering the account fixed the refusals; without this change the fresh registration would have been discarded on the next run exactly like every refresh before it. Also corrects the init container comment, which claimed the sentinel preserved token refreshes. It preserves the DB; it never preserved the tokens. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-16 18:26:49 +02:00
k.renner	edb07a344e	Merge pull request 'fix(libation): pin image to 14.2.1 by digest' (#860 ) from fix/libation-pin-14.2.1 into master ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#860	2026-09-16 15:51:49 +00:00
claude-botandClaude Opus 5	260f548e67	fix(libation): pin image to 14.2.1 by digest ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details The CronJob ran `rmcrackan/libation:latest` with imagePullPolicy Always but was stuck on 13.7.11 (2026-08-24). Spegel answers containerd's tag resolution from its peer cache -- a 200 from the mirror is a hit, so upstream is never consulted and the tag never advances. Verified: the pod's imageID was sha256:946177d3 (= tag 13.7.11) while Docker Hub's :latest pointed at sha256:6f9d8ba1 (= 14.2.1), and querying a Spegel pod's registry port directly returned the stale digest for that tag. Audible changed device registration in early September; upstream shipped an experimental fix in 14.1 and the real fix in 14.2, so the stale image predates both. Since 2026-09-15 three newly purchased titles fail with "Content license denied" and the library has not grown. A digest reference is immune to the mirror's tag cache. Note that the upstream maintainer's remedy also requires removing and re-adding the Audible account with an interactive login, which this change does not and cannot perform. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-16 17:30:37 +02:00
k.renner	ef6bc24491	Merge pull request 'feat(ceph): serve reads from the local OSD (#576 )' (#859 ) from feat/ceph-read-affinity into master ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#859	2026-09-16 12:25:51 +00:00