Closed lonix1 closed 1 year ago
tldr: add an internal token for cli/api administration tasks ...
... in this regards woodpecker does not have a own user-registry - we exclusively use Oauth2
So you would set the token as a environment variable in the server container and also the cli container?
(Similar to what we have now with WOODPECKER_AGENT_SECRET
.)
In this PR someone wrote down a smart way to login to Woodpecker: https://github.com/earl-warren/woodpecker/blob/6d1dc73418c4c6054a200c73098aaec81f9c0d1f/.woodpecker/forgejo.yml#L35
Component
server, cli
Describe the bug
This is not strictly a bug, but a design flaw. I first asked on the discord server.
Suppose I want to lock down my woodpecker server - I don't want random users from my gitea server to be able to log in. So I set
WOODPECKER_OPEN=false
. The docs state that in that case I need to create users manually, using the CLI.The problem is the CLI needs an auth token, to be able to communicate with the server. But to generate such a token I must log in to the server, which I can't do. A chicken and egg problem! :baby_chick: :egg:
System Info
Additional context
Idea: have the CLI inside the server container, and allow it to communicate without an auth token.
Idea: proposed by @6543:
Validations
next
version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]