From 79f0c1a2938fe13c84c2300f8a397a1b9e353f9c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Kr=C3=BCger?= Date: Mon, 24 Aug 2026 11:39:06 +0200 Subject: [PATCH] fix(gitea): cache-server needs external_secret, not external_secret_file The cache-server subcommand only checks the literal external_secret field at startup and errors out if just external_secret_file is set (unlike the daemon, which handles _file fine). Move its config out of git entirely - it now has to hold the actual secret value - generated straight into .data on the VPS instead. --- gitea/cache-server-config.yaml | 5 ----- gitea/compose.yml | 9 +++++++-- 2 files changed, 7 insertions(+), 7 deletions(-) delete mode 100644 gitea/cache-server-config.yaml diff --git a/gitea/cache-server-config.yaml b/gitea/cache-server-config.yaml deleted file mode 100644 index c2050f9..0000000 --- a/gitea/cache-server-config.yaml +++ /dev/null @@ -1,5 +0,0 @@ -cache: - # Path to the shared secret file (generated on the VPS directly, outside - # git - see /root/stacks/.data/gitea/cache_secret). Must match - # external_secret_file in runner-config.yaml exactly. - external_secret_file: "/data/cache_secret" diff --git a/gitea/compose.yml b/gitea/compose.yml index 026cd1d..87bc85f 100644 --- a/gitea/compose.yml +++ b/gitea/compose.yml @@ -110,8 +110,13 @@ services: - "8088:8088" volumes: - ../.data/gitea/runner-cache:/data/cache - - ./cache-server-config.yaml:/data/config.yaml:ro - - ../.data/gitea/cache_secret:/data/cache_secret:ro + # Unlike the daemon (runner-config.yaml, external_secret_file works + # fine there), the cache-server subcommand only checks the literal + # external_secret field and errors out ("must be set") if only + # external_secret_file is given. So this file has to hold the actual + # secret value - kept out of git entirely, generated straight into + # .data on the VPS (see the cache_secret file it reads from). + - ../.data/gitea/cache-server-config.yaml:/data/config.yaml:ro restart: always networks: - compose_network