From 1266c433e6f2cd886b9975c2cf833872889201f9 Mon Sep 17 00:00:00 2001
From: Konstantin Renner <konstantin@renner.uno>
Date: Fri, 26 Jun 2026 14:08:38 +0200
Subject: [PATCH] ci: add deploy-woodpecker-agent pipeline
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The woodpecker-agent role had no deploy pipeline — so the Docker IPv6
daemon.json (PR #48) landed in git but never reached the agents. Mirror
the other deploy-* pipelines: master + manual trigger, runs
install-woodpecker-agent.yml in the ci-ansible runner.

Merging self-triggers on its own path and applies the agent config. It
deploys the agents from an agent, so the Docker restart kills this job
mid-run (reported as failure) but still applies on both agents; re-trigger
deploy-netbird-proxy after.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .woodpecker/deploy-woodpecker-agent.yml | 43 +++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 .woodpecker/deploy-woodpecker-agent.yml

diff --git a/.woodpecker/deploy-woodpecker-agent.yml b/.woodpecker/deploy-woodpecker-agent.yml
new file mode 100644
index 00000000..7ecccc0b
--- /dev/null
+++ b/.woodpecker/deploy-woodpecker-agent.yml
@@ -0,0 +1,43 @@
+when:
+  # Deploy only on master (merge) + manual — never from a feature branch.
+  - event: push
+    branch: master
+    path:
+      - "ansible/roles/woodpecker-agent/**"
+      - "ansible/plays/install-woodpecker-agent.yml"
+      - ".woodpecker/deploy-woodpecker-agent.yml"
+  - event: manual
+    evaluate: 'PIPELINE == "deploy-woodpecker-agent"'
+
+# NOTE: this deploys the agents *from* an agent, so applying a change that
+# restarts Docker (e.g. the daemon.json IPv6 config) will kill this job's own
+# container mid-run — the pipeline reports failure, but the change still
+# applies on both agents (the restart commands are dispatched in parallel
+# before the executing agent's daemon goes down). Re-run / re-trigger
+# deploy-netbird-proxy afterwards.
+timeout: 30
+
+steps:
+  - name: deploy-woodpecker-agent
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
+    environment:
+      ANSIBLE_FORCE_COLOR: "true"
+      ANSIBLE_HOST_KEY_CHECKING: "false"
+      ANSIBLE_ROLES_PATH: "../roles:./roles"
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      VAULT_PASS:
+        from_secret: vault_pass
+      PROXMOX_TOKEN_ID:
+        from_secret: proxmox_token_id
+      PROXMOX_TOKEN_SECRET:
+        from_secret: proxmox_token_secret
+    commands:
+      - mkdir -p ~/.ssh
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
+      - chmod 600 ~/.ssh/id_ed25519
+      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
+      - cd ansible
+      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
+      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
+      - ansible-playbook -i inventory/ plays/install-woodpecker-agent.yml -v
-- 
2.54.0