[GH-ISSUE #927] [Bug] Repo "On Clone"/"On Pull" scripts not usefull for Sync/Deploy Stack #3660

New Issue

GiteaMirror · 2026-04-13T15:08:55-05:00

GiteaMirror commented

2026-04-13 15:08:55 -05:00

Originally created by @joecksma on GitHub (Oct 19, 2025).
Original GitHub issue: https://github.com/moghtech/komodo/issues/927

Hello,

I want to use Repos scripts to use sops to decrypt my env files. This works as expected. But the decrypted files are not available to "Run Sync" and "Deploy Stack" Executions (as they seem to use the /repo-cache).

Is it intended that the scripts only edit the periphery copy and not the /repo-cache?

Example of an Error:

ERROR: Failed to read file contents from "/repo-cache/github.com/gitaccount-repo/main/latest/services/server/it-tools/compose.env"

TRACE:
	1: No such file or directory (os error 2)

The file exists, but only under /data/repos/repo/services/server/it-tools/compose.env

My config

compose.yaml

services:
  mongo:
    image: mongo:8.0.15@sha256:d0d76261e7a19aee701e890a9e835ba369a12b8733e7d39cd89a923ed97f247c
    labels:
      komodo.skip: # Prevent Komodo from stopping with StopAllContainers
    command: --quiet --wiredTigerCacheSizeGB 0.25
    restart: unless-stopped
    volumes:
      - ${KOMODO_BASE_PATH}/mongo/data:/data/db
      - ${KOMODO_BASE_PATH}/mongo/config:/data/configdb
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${KOMODO_DB_USERNAME}
      MONGO_INITDB_ROOT_PASSWORD: ${KOMODO_DB_PASSWORD}
  
  core:
    image: ghcr.io/moghtech/komodo-core:1.19.5@sha256:a1cceb4f971443b1e9f2a767788f663d0afb6244ee2135f7fe3fd1036af37ade

    labels:
      komodo.skip: # Prevent Komodo from stopping with StopAllContainers
    restart: unless-stopped
    depends_on:
      - mongo
    ports:
      - 9120:9120
    env_file: ./compose.env
    environment:
      KOMODO_DATABASE_ADDRESS: mongo:27017
      KOMODO_DATABASE_USERNAME: ${KOMODO_DB_USERNAME}
      KOMODO_DATABASE_PASSWORD: ${KOMODO_DB_PASSWORD}
    volumes:
      - ${KOMODO_BASE_PATH}/backups:/backups
      - ${KOMODO_BASE_PATH}/repo-cache:/repo-cache

  periphery:
    image: ghcr.io/moghtech/komodo-periphery:1.19.5@sha256:bd79cf960ed054fe8e02384322303e462448679b1149dde48bbef151417255b1
    labels:
      komodo.skip: # Prevent Komodo from stopping with StopAllContainers
    restart: unless-stopped
    env_file: ./compose.env
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /proc:/proc
      - ${KOMODO_BASE_PATH}/data:${KOMODO_BASE_PATH}/data
      - ${KOMODO_BASE_PATH}/repos:${KOMODO_BASE_PATH}/repos

komodo-config.toml

[[server]]
name = "server"
[server.config]
enabled = true

##

[[stack]]
name = "it-tools"
[stack.config]
server = "server"
linked_repo = "repo"
run_directory = "services/server/it-tools"
additional_env_files = ["compose.env"]

##

[[repo]]
name = "repo"
[repo.config]
server = "server"
builder = "server"
git_account = "gitaccount"
repo = "gitaccount/repo"
on_clone.command = """
cat .env | grep "AGE_KEY_" | cut -d '=' -f2- > age.key
find . -name "*.sops.env" -exec sh -c 'docker run --rm -v "$PWD:/sops" -e SOPS_AGE_KEY_FILE=/sops/age.key -w /sops chatwork/sops -d "{}" > "$(echo "{}" | sed 's/.sops.env/.env/')"' ';'
find . -name "*.sops.toml" -exec sh -c 'docker run --rm -v "$PWD:/sops" -e SOPS_AGE_KEY_FILE=/sops/age.key -w /sops chatwork/sops -d "{}" > "$(echo "{}" | sed 's/.sops.toml/.toml/')"' ';'
shred age.key
"""
on_pull.command = """
cat .env | grep "AGE_KEY_" | cut -d '=' -f2- > age.key
find . -name "*.sops.env" -exec sh -c 'docker run --rm -v "$PWD:/sops" -e SOPS_AGE_KEY_FILE=/sops/age.key -w /sops chatwork/sops -d "{}" > "$(echo "{}" | sed 's/.sops.env/.env/')"' ';'
find . -name "*.sops.toml" -exec sh -c 'docker run --rm -v "$PWD:/sops" -e SOPS_AGE_KEY_FILE=/sops/age.key -w /sops chatwork/sops -d "{}" > "$(echo "{}" | sed 's/.sops.toml/.toml/')"' ';'
shred age.key
"""
environment = """
AGE_KEY_1=[[AGE_KEY_1]]
AGE_KEY_2=[[AGE_KEY_2]]
AGE_KEY_3=[[AGE_KEY_3]]
"""

##

[[procedure]]
name = "Backup Core Database"
description = "Triggers the Core database backup at the scheduled time."
tags = ["system"]
config.schedule = "Every day at 01:00"

[[procedure.config.stage]]
name = "Stage 1"
enabled = true
executions = [
  { execution.type = "BackupCoreDatabase", execution.params = {}, enabled = true }
]

##

[[procedure]]
name = "Global Auto Update"
description = "Pulls and auto updates Stacks and Deployments using 'poll_for_updates' or 'auto_update'."
tags = ["system"]
config.schedule = "Every day at 03:00"

[[procedure.config.stage]]
name = "Stage 1"
enabled = true
executions = [
  { execution.type = "GlobalAutoUpdate", execution.params = {}, enabled = true }
]

##

[[procedure]]
name = "pull-and-deploy"
description = "Pulls stack-repo, deploys stacks"
config.schedule_format = "Cron"
config.schedule = "0 0,15,30,45 * * * *"

[[procedure.config.stage]]
name = "Pull Repo"
enabled = true
executions = [
  { execution.type = "PullRepo", execution.params.repo = "repo", enabled = true }
]

[[procedure.config.stage]]
name = "Sync Komodo Config"
enabled = true
executions = [
  { execution.type = "RunSync", execution.params.sync = "komodo-config", enabled = true }
]

[[procedure.config.stage]]
name = "Update Stacks"
enabled = true
executions = [
  { execution.type = "BatchDeployStackIfChanged", execution.params.pattern = "*", enabled = true }
]

[[procedure.config.stage]]
name = "Prune System"
enabled = true
executions = [
  { execution.type = "PruneSystem", execution.params.server = "server", enabled = true }
]

##

[[builder]]
name = "server"
[builder.config]
type = "Server"
params.server_id = "server"

##

[[resource_sync]]
name = "komodo-config"
[resource_sync.config]
linked_repo = "repo"
resource_path = ["komodo-config.toml"]
managed = true

Thank you in advance for your help.

Originally created by @joecksma on GitHub (Oct 19, 2025). Original GitHub issue: https://github.com/moghtech/komodo/issues/927 Hello, I want to use Repos scripts to use sops to decrypt my env files. This works as expected. But the decrypted files are not available to "Run Sync" and "Deploy Stack" Executions (as they seem to use the /repo-cache). Is it intended that the scripts only edit the periphery copy and not the /repo-cache? Example of an Error: ``` ERROR: Failed to read file contents from "/repo-cache/github.com/gitaccount-repo/main/latest/services/server/it-tools/compose.env" TRACE: 1: No such file or directory (os error 2) ``` The file exists, but only under /data/repos/repo/services/server/it-tools/compose.env ### My config <details> <summary>compose.yaml</summary> ```yaml services: mongo: image: mongo:8.0.15@sha256:d0d76261e7a19aee701e890a9e835ba369a12b8733e7d39cd89a923ed97f247c labels: komodo.skip: # Prevent Komodo from stopping with StopAllContainers command: --quiet --wiredTigerCacheSizeGB 0.25 restart: unless-stopped volumes: - ${KOMODO_BASE_PATH}/mongo/data:/data/db - ${KOMODO_BASE_PATH}/mongo/config:/data/configdb environment: MONGO_INITDB_ROOT_USERNAME: ${KOMODO_DB_USERNAME} MONGO_INITDB_ROOT_PASSWORD: ${KOMODO_DB_PASSWORD} core: image: ghcr.io/moghtech/komodo-core:1.19.5@sha256:a1cceb4f971443b1e9f2a767788f663d0afb6244ee2135f7fe3fd1036af37ade labels: komodo.skip: # Prevent Komodo from stopping with StopAllContainers restart: unless-stopped depends_on: - mongo ports: - 9120:9120 env_file: ./compose.env environment: KOMODO_DATABASE_ADDRESS: mongo:27017 KOMODO_DATABASE_USERNAME: ${KOMODO_DB_USERNAME} KOMODO_DATABASE_PASSWORD: ${KOMODO_DB_PASSWORD} volumes: - ${KOMODO_BASE_PATH}/backups:/backups - ${KOMODO_BASE_PATH}/repo-cache:/repo-cache periphery: image: ghcr.io/moghtech/komodo-periphery:1.19.5@sha256:bd79cf960ed054fe8e02384322303e462448679b1149dde48bbef151417255b1 labels: komodo.skip: # Prevent Komodo from stopping with StopAllContainers restart: unless-stopped env_file: ./compose.env volumes: - /var/run/docker.sock:/var/run/docker.sock - /proc:/proc - ${KOMODO_BASE_PATH}/data:${KOMODO_BASE_PATH}/data - ${KOMODO_BASE_PATH}/repos:${KOMODO_BASE_PATH}/repos ``` </details> <details> <summary>komodo-config.toml</summary> ```yaml [[server]] name = "server" [server.config] enabled = true ## [[stack]] name = "it-tools" [stack.config] server = "server" linked_repo = "repo" run_directory = "services/server/it-tools" additional_env_files = ["compose.env"] ## [[repo]] name = "repo" [repo.config] server = "server" builder = "server" git_account = "gitaccount" repo = "gitaccount/repo" on_clone.command = """ cat .env | grep "AGE_KEY_" | cut -d '=' -f2- > age.key find . -name "*.sops.env" -exec sh -c 'docker run --rm -v "$PWD:/sops" -e SOPS_AGE_KEY_FILE=/sops/age.key -w /sops chatwork/sops -d "{}" > "$(echo "{}" | sed 's/.sops.env/.env/')"' ';' find . -name "*.sops.toml" -exec sh -c 'docker run --rm -v "$PWD:/sops" -e SOPS_AGE_KEY_FILE=/sops/age.key -w /sops chatwork/sops -d "{}" > "$(echo "{}" | sed 's/.sops.toml/.toml/')"' ';' shred age.key """ on_pull.command = """ cat .env | grep "AGE_KEY_" | cut -d '=' -f2- > age.key find . -name "*.sops.env" -exec sh -c 'docker run --rm -v "$PWD:/sops" -e SOPS_AGE_KEY_FILE=/sops/age.key -w /sops chatwork/sops -d "{}" > "$(echo "{}" | sed 's/.sops.env/.env/')"' ';' find . -name "*.sops.toml" -exec sh -c 'docker run --rm -v "$PWD:/sops" -e SOPS_AGE_KEY_FILE=/sops/age.key -w /sops chatwork/sops -d "{}" > "$(echo "{}" | sed 's/.sops.toml/.toml/')"' ';' shred age.key """ environment = """ AGE_KEY_1=[[AGE_KEY_1]] AGE_KEY_2=[[AGE_KEY_2]] AGE_KEY_3=[[AGE_KEY_3]] """ ## [[procedure]] name = "Backup Core Database" description = "Triggers the Core database backup at the scheduled time." tags = ["system"] config.schedule = "Every day at 01:00" [[procedure.config.stage]] name = "Stage 1" enabled = true executions = [ { execution.type = "BackupCoreDatabase", execution.params = {}, enabled = true } ] ## [[procedure]] name = "Global Auto Update" description = "Pulls and auto updates Stacks and Deployments using 'poll_for_updates' or 'auto_update'." tags = ["system"] config.schedule = "Every day at 03:00" [[procedure.config.stage]] name = "Stage 1" enabled = true executions = [ { execution.type = "GlobalAutoUpdate", execution.params = {}, enabled = true } ] ## [[procedure]] name = "pull-and-deploy" description = "Pulls stack-repo, deploys stacks" config.schedule_format = "Cron" config.schedule = "0 0,15,30,45 * * * *" [[procedure.config.stage]] name = "Pull Repo" enabled = true executions = [ { execution.type = "PullRepo", execution.params.repo = "repo", enabled = true } ] [[procedure.config.stage]] name = "Sync Komodo Config" enabled = true executions = [ { execution.type = "RunSync", execution.params.sync = "komodo-config", enabled = true } ] [[procedure.config.stage]] name = "Update Stacks" enabled = true executions = [ { execution.type = "BatchDeployStackIfChanged", execution.params.pattern = "*", enabled = true } ] [[procedure.config.stage]] name = "Prune System" enabled = true executions = [ { execution.type = "PruneSystem", execution.params.server = "server", enabled = true } ] ## [[builder]] name = "server" [builder.config] type = "Server" params.server_id = "server" ## [[resource_sync]] name = "komodo-config" [resource_sync.config] linked_repo = "repo" resource_path = ["komodo-config.toml"] managed = true ```` </details> Thank you in advance for your help.

GiteaMirror commented

2026-04-13 15:08:56 -05:00

@jpod20 commented on GitHub (Oct 20, 2025):

I was running into the same issue but I think I discovered the solution. In the new compose files it no longer lists the repo-cache as a volume to be mounted. I removed it from my set up and I no longer receive that error.

https://github.com/moghtech/komodo/blob/main/compose/mongo.compose.yaml

@jpod20 commented on GitHub (Oct 20, 2025): I was running into the same issue but I think I discovered the solution. In the new compose files it no longer lists the repo-cache as a volume to be mounted. I removed it from my set up and I no longer receive that error. https://github.com/moghtech/komodo/blob/main/compose/mongo.compose.yaml

GiteaMirror commented

2026-04-13 15:08:56 -05:00

@joecksma commented on GitHub (Oct 23, 2025):

I removed the repo cache from the volume mapping, but the behaviour is unchanged.

The Stack-UI reads the file from /repo-cache/github.com/gitaccount-repo/main/latest/services/server/it-tools/compose.env (core)

while the repo is executing the script on ${KOMODO_BASE_PATH}/data/repos/homelab (periphery)

@joecksma commented on GitHub (Oct 23, 2025): I removed the repo cache from the volume mapping, but the behaviour is unchanged. The Stack-UI reads the file from `/repo-cache/github.com/gitaccount-repo/main/latest/services/server/it-tools/compose.env` (core) while the repo is executing the script on `${KOMODO_BASE_PATH}/data/repos/homelab` (periphery)

GiteaMirror commented

2026-04-13 15:08:57 -05:00

@Rustymage commented on GitHub (Oct 30, 2025):

I have this issue too.

@Rustymage commented on GitHub (Oct 30, 2025): I have this issue too.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/komodo#3660