ci: inject TUNNEL_TOKEN from secrets into deploy env before scp #132

Merged

fastie81 merged 1 commit from fix/inject-tunnel-token into main

2026-09-05 23:20:42 +12:00

fastie81 commented

2026-09-05 23:20:26 +12:00

Owner

Change: render secrets.TUNNEL_TOKEN into .env.prod / .env.test in both deploy jobs (alongside the existing Google secret rendering) before scp, so the tunnel always receives its token on deploy. The token lives in the Forgejo Actions secret TUNNEL_TOKEN.

This was surfaced by running the full pipeline to prod for the first time (v3.4.4).

Fix: deploy-prod was overwriting prod's .env.prod with the repo copy, which lacks the Cloudflare tunnel token, so every CI deploy recreated the tunnel with an empty token and it crash-looped (observed: RestartCount=8). Same latent issue in deploy-test. Change: render secrets.TUNNEL_TOKEN into .env.prod / .env.test in both deploy jobs (alongside the existing Google secret rendering) before scp, so the tunnel always receives its token on deploy. The token lives in the Forgejo Actions secret TUNNEL_TOKEN. This was surfaced by running the full pipeline to prod for the first time (v3.4.4).

fastie81 added 1 commit

2026-09-05 23:20:27 +12:00

ci: inject TUNNEL_TOKEN from secrets into deploy env before scp

CI / test (push) Successful in 2m12s

Details

CI / lint-frontend (push) Successful in 59s

Details

CI / build (push) Successful in 3m27s

Details

CI / deploy-test (push) Has been skipped

Details

CI / deploy-prod (push) Has been skipped

Details

e940295bdc

deploy-prod overwrites prod's .env.prod with the repo copy, which lacks the
Cloudflare tunnel token, so each CI prod deploy recreates the tunnel with an
empty token -> crash loop (restarts up to 8). deploy-test has the same latent
issue for its env.

Render secrets.TUNNEL_TOKEN into .env.prod / .env.test in both deploy jobs
(alongside the existing Google secret rendering) so the tunnel always gets its
token on deploy. The token lives in the Forgejo Actions secret TUNNEL_TOKEN.

fastie81 merged commit 40ff811480 into main

2026-09-05 23:20:42 +12:00

fastie81 referenced this pull request from a commit

2026-09-05 23:20:46 +12:00

Merge pull request 'ci: inject TUNNEL_TOKEN from secrets into deploy env before scp' (#132) from fix/inject-tunnel-token into main