konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

feat(wiki): API key "paperclip" for the Paperclip agents #972

Merged
k.renner merged 1 commits from feat/wiki-api-key-paperclip into master 2026-09-25 17:35:28 +00:00
Conversation 1 Commits 1 Files Changed 1
+4
claude-bot commented 2026-09-25 17:33:39 +00:00
Member
Copy Link
Copy Source

Adds a second named wiki API key. The value is already in OpenBao (homelab/apps/ai/wiki-api-keys, property paperclip, version 4, minted with openssl rand -hex 32, no trailing newline this time). This PR maps it to Auth__ApiKeys__paperclip; facts and answers written with it are attributed as captured_by: paperclip. Reloader restarts the pod once the Secret changes.

🤖 Generated with Claude Code

Adds a second named wiki API key. The value is already in OpenBao (`homelab/apps/ai/wiki-api-keys`, property `paperclip`, version 4, minted with `openssl rand -hex 32`, no trailing newline this time). This PR maps it to `Auth__ApiKeys__paperclip`; facts and answers written with it are attributed as `captured_by: paperclip`. Reloader restarts the pod once the Secret changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
claude-bot added 1 commit 2026-09-25 17:33:40 +00:00
feat(wiki): API key "paperclip" for the Paperclip agents
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details
f732528551 
Second named key in apps/ai/wiki-api-keys (OpenBao version 4), mapped to
Auth__ApiKeys__paperclip; writes through the API are attributed to it.
Reloader rolls the pod when the Secret changes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
k.renner merged commit cf362548f1 into master 2026-09-25 17:35:28 +00:00
review-bot left a comment
Member
Copy Link
Copy Source

🤖 Automated review — model CLI default (complexity: unknown), commit f732528551c55ea986fd51787ab84c906567cc33.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Adds a second named API-key entry (paperclip) to the existing wiki-api-keys ExternalSecret in kubernetes/apps/wiki/externalsecrets.yaml, mirroring the pre-existing workstation entry exactly. No blocking issues found.

Tests

This is a GitOps manifest change, not application code — no unit tests apply. The change carries its own "test": ESO must be able to resolve apps/ai/wiki-api-keys / paperclip from OpenBao, and wiki-deployment.yaml's envFrom: secretRef: wiki-api-keys plus the existing secret.reloader.stakater.com/reload: ...,wiki-api-keys,... annotation (kubernetes/apps/wiki/deployment.yaml:27,79-80) will pick up the new env var and roll the pod automatically — no deployment changes were needed or made, which is correct.

Verification notes

  • The new block (kubernetes/apps/wiki/externalsecrets.yaml:45-48) matches the structure, indentation, and naming convention (Auth__ApiKeys__<name> / remoteRef.property: <name>) of the existing workstation entry (lines 41-44) exactly.
  • No secret values are committed — only a reference to an OpenBao path/property, consistent with the rest of the file.
  • Confirmed via kubernetes/apps/wiki/deployment.yaml that wiki-api-keys is consumed wholesale via envFrom.secretRef (not individual key references), so no other file needs updating for the new key to reach the pod.
  • The block comment at externalsecrets.yaml:27 ("One API key per machine identity... field = name") already documents this pattern, so no new comment was needed.
  • Could not verify from this repo that the Wiki application (external konairius/wiki image) actually maps the paperclip identity to captured_by: paperclip as claimed in the PR body — that logic lives outside this repository and isn't checkable here. This is consistent with how workstation was added previously, so it's a reasonable, low-risk assumption rather than a defect.

Recommendation

Looks reasonable — no blocking issues; comments above are informational only.

🤖 **Automated review** — model `CLI default` (complexity: unknown), commit `f732528551c55ea986fd51787ab84c906567cc33`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Adds a second named API-key entry (`paperclip`) to the existing `wiki-api-keys` `ExternalSecret` in `kubernetes/apps/wiki/externalsecrets.yaml`, mirroring the pre-existing `workstation` entry exactly. No blocking issues found. ## Tests This is a GitOps manifest change, not application code — no unit tests apply. The change carries its own "test": ESO must be able to resolve `apps/ai/wiki-api-keys` / `paperclip` from OpenBao, and `wiki-deployment.yaml`'s `envFrom: secretRef: wiki-api-keys` plus the existing `secret.reloader.stakater.com/reload: ...,wiki-api-keys,...` annotation (`kubernetes/apps/wiki/deployment.yaml:27,79-80`) will pick up the new env var and roll the pod automatically — no deployment changes were needed or made, which is correct. ## Verification notes - The new block (`kubernetes/apps/wiki/externalsecrets.yaml:45-48`) matches the structure, indentation, and naming convention (`Auth__ApiKeys__<name>` / `remoteRef.property: <name>`) of the existing `workstation` entry (lines 41-44) exactly. - No secret values are committed — only a reference to an OpenBao path/property, consistent with the rest of the file. - Confirmed via `kubernetes/apps/wiki/deployment.yaml` that `wiki-api-keys` is consumed wholesale via `envFrom.secretRef` (not individual key references), so no other file needs updating for the new key to reach the pod. - The block comment at `externalsecrets.yaml:27` ("One API key per machine identity... field = name") already documents this pattern, so no new comment was needed. - Could not verify from this repo that the Wiki application (external `konairius/wiki` image) actually maps the `paperclip` identity to `captured_by: paperclip` as claimed in the PR body — that logic lives outside this repository and isn't checkable here. This is consistent with how `workstation` was added previously, so it's a reasonable, low-risk assumption rather than a defect. ## Recommendation Looks reasonable — no blocking issues; comments above are informational only. <!-- pr-review:sha=f732528551c55ea986fd51787ab84c906567cc33 -->
Sign in to join this conversation.
Reviewers
No Reviewers
review-bot
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#972