feat: seed cmd_and_ctrl bug-report PAT via cloud-init (TF_VAR wiring)#49
Open
krakenhavoc wants to merge 2 commits into
Open
feat: seed cmd_and_ctrl bug-report PAT via cloud-init (TF_VAR wiring)#49krakenhavoc wants to merge 2 commits into
krakenhavoc wants to merge 2 commits into
Conversation
New sensitive variable cmd_and_ctrl_github_token adds an optional CMDCTRL_GITHUB_TOKEN line to the game server's cloud-init env file, so a rebuilt VM boots with the in-app bug-report feature live (cmd_and_ctrl ADR 0017). Wired through the existing secret path: CMD_AND_CTRL_GITHUB_TOKEN environment secret (lab) -> lab-deploy -> terraform-ci TF_VAR, exactly like the admin/tunnel tokens. The steady-state host copy is synced by the cmd_and_ctrl repo's own CD from that repo's CMDCTRL_GITHUB_TOKEN Actions secret, which stays hand-managed: a Terraform github provider (and its credential) wasn't justified for one secret. Empty variable (default) is a verified no-op — rendered cloud-init is byte-identical to HEAD. Hook-equivalents run out-of-band (sandbox couldn't exec the hl-venv interpreter): terraform fmt/validate/tflint clean, trivy config scan 0 findings, workflow YAML parses. CI pre-commit re-checks on the PR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
krakenhavoc
had a problem deploying
to
frontends-dev
July 8, 2026 18:09 — with 
GitHub Actions
Failure
GitHub Actions
Failure
Terraform Plan Summary (
|
| Action | Count |
|---|---|
| ➕ Create | 2 |
| 🔁 Update | 1 |
| ❌ Destroy | 2 |
Workspace: lab | Path: terraform/deployments/lab
The disk was grown to 100G out-of-band; config had drifted at 50. bpg/proxmox only ever grows disks in-place, so aligning config to the actual size is non-destructive — the plan should show an in-place size update (or nothing after refresh). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Terraform Plan Summary (
|
Terraform Plan Summary (
|
| Action | Count |
|---|---|
| ➕ Create | 1 |
| 🔁 Update | 0 |
| ❌ Destroy | 1 |
Workspace: shared | Path: terraform/deployments/shared
Terraform Plan Summary (
|
| Action | Count |
|---|---|
| ➕ Create | 0 |
| 🔁 Update | 1 |
| ❌ Destroy | 0 |
Workspace: frontends-dev | Deployment: terraform/deployments/frontends
Terraform Plan Summary (
|
| Action | Count |
|---|---|
| ➕ Create | 0 |
| 🔁 Update | 1 |
| ❌ Destroy | 0 |
Workspace: nfs-prd | Path: terraform/deployments/nfs
Terraform Plan Summary (
|
| Action | Count |
|---|---|
| ➕ Create | 0 |
| 🔁 Update | 1 |
| ❌ Destroy | 0 |
Workspace: nfs-dev | Path: terraform/deployments/nfs
Terraform Plan Summary (
|
| Action | Count |
|---|---|
| ➕ Create | 0 |
| 🔁 Update | 1 |
| ❌ Destroy | 0 |
Workspace: plex-dev | Path: terraform/deployments/plex
Terraform Plan Summary (
|
| Action | Count |
|---|---|
| ➕ Create | 0 |
| 🔁 Update | 1 |
| ❌ Destroy | 0 |
Workspace: plex-prd | Path: terraform/deployments/plex
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New sensitive variable cmd_and_ctrl_github_token adds an optional CMDCTRL_GITHUB_TOKEN line to the game server's cloud-init env file, so a rebuilt VM boots with the in-app bug-report feature live (cmd_and_ctrl ADR 0017). Wired through the existing secret path: CMD_AND_CTRL_GITHUB_TOKEN environment secret (lab) -> lab-deploy -> terraform-ci TF_VAR, exactly like the admin/tunnel tokens. The steady-state host copy is synced by the cmd_and_ctrl repo's own CD from that repo's CMDCTRL_GITHUB_TOKEN Actions secret, which stays hand-managed: a Terraform github provider (and its credential) wasn't justified for one secret. Empty variable (default) is a verified no-op — rendered cloud-init is byte-identical to HEAD.
Hook-equivalents run out-of-band (sandbox couldn't exec the hl-venv interpreter): terraform fmt/validate/tflint clean, trivy config scan 0 findings, workflow YAML parses. CI pre-commit re-checks on the PR.