kuma-setup.js now logs in after the admin setup and converges on every run:
- settings: Trust Proxy on, Primary Base URL https://kuma.renner.uno.
Read-modify-write; unset keys get the same defaults the Kuma settings page
applies before saving (a raw getSettings payload has nscd unset, which makes
setSettings stop nscd).
- notification "email" (SMTP, default enabled, applied to existing monitors):
created or updated in place by name, never duplicated. Credentials from
OpenBao homelab/infrastructure/uptime-kuma/smtp; recipient is the
Alertmanager receiver admin@renner.uno; 465 means implicit TLS, else STARTTLS.
- status page "renner" / "Renner" with custom domain uptime.renner.uno. Only
title and domain are enforced; saveStatusPage replaces all groups, so the
current publicGroupList from /api/status-page/<slug> is sent back unchanged.
Steady state does not call saveStatusPage at all.
- metrics API key "prometheus": Ansible checks the key stored at
homelab/infrastructure/uptime-kuma-metrics against /metrics; if it is
missing or rejected the script deletes all "prometheus" keys, creates a new
one and hands it over via a 0600 file in the data dir, which Ansible writes
to OpenBao (vault_kv2_write, community.hashi_vault 7.1.0 in the CI image)
and then removes. The key never reaches stdout/stderr or the Ansible log.
The script is restructured into small async steps with per-emit timeouts.
The uptime-kuma-vps policy gains read on the smtp path and
read/create/update on the metrics path (must be applied by hand).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude-botandClaude Opus 5.5
67aadbc0f9