From f49dcf33ee13761c49d1ad4bb5b999aace21cb03 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 1 May 2026 09:48:33 +0000 Subject: [PATCH 1/3] Initial plan From 5955d95ccbd957ba6e9a4f8bfba08f8bea0699c6 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 1 May 2026 09:50:06 +0000 Subject: [PATCH 2/3] Fail fast when no Azure auth credentials configured for abs:// litestream URL Agent-Logs-Url: https://github.com/privacyint/docker-headscale/sessions/4b3e8248-4d6f-421d-a6c4-e5c103558d01 Co-authored-by: EdGeraghty <20861699+EdGeraghty@users.noreply.github.com> --- scripts/container-entrypoint.sh | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/scripts/container-entrypoint.sh b/scripts/container-entrypoint.sh index d87570b..25da099 100755 --- a/scripts/container-entrypoint.sh +++ b/scripts/container-entrypoint.sh @@ -113,8 +113,15 @@ check_litestream_replica_url() { require_env_var "LITESTREAM_SECRET_ACCESS_KEY" ;; ABS://*) - # Azure Blob can authenticate with an account key, managed identity, - # or other Azure credential chain methods supported by Litestream. + # Azure Blob Storage requires at least one auth mechanism: + # 1. Account key + # 2. Service principal (client ID + tenant ID + client secret) + # 3. Managed identity (IDENTITY_ENDPOINT set by the Azure runtime) + if ! env_var_is_defined "LITESTREAM_AZURE_ACCOUNT_KEY" && \ + ! (env_var_is_defined "AZURE_CLIENT_ID" && env_var_is_defined "AZURE_TENANT_ID" && env_var_is_defined "AZURE_CLIENT_SECRET") && \ + ! env_var_is_defined "IDENTITY_ENDPOINT"; then + log_error "Azure Blob Storage ('abs://') requires at least one auth mechanism: 'LITESTREAM_AZURE_ACCOUNT_KEY', service-principal vars ('AZURE_CLIENT_ID', 'AZURE_TENANT_ID', 'AZURE_CLIENT_SECRET'), or managed identity ('IDENTITY_ENDPOINT')." + fi ;; *) log_error "Invalid 'LITESTREAM_REPLICA_URL'. Must start with 's3://', 'abs://', or be set to 'DISABLED_I_KNOW_WHAT_IM_DOING'." From 30f5a48448690766eb524d064f5d3eed4dacf4b6 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 1 May 2026 09:51:56 +0000 Subject: [PATCH 3/3] Use || chain so failed Azure credential check exits under set -e Agent-Logs-Url: https://github.com/privacyint/docker-headscale/sessions/4b3e8248-4d6f-421d-a6c4-e5c103558d01 Co-authored-by: EdGeraghty <20861699+EdGeraghty@users.noreply.github.com> --- scripts/container-entrypoint.sh | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/scripts/container-entrypoint.sh b/scripts/container-entrypoint.sh index 25da099..10c5601 100755 --- a/scripts/container-entrypoint.sh +++ b/scripts/container-entrypoint.sh @@ -117,11 +117,10 @@ check_litestream_replica_url() { # 1. Account key # 2. Service principal (client ID + tenant ID + client secret) # 3. Managed identity (IDENTITY_ENDPOINT set by the Azure runtime) - if ! env_var_is_defined "LITESTREAM_AZURE_ACCOUNT_KEY" && \ - ! (env_var_is_defined "AZURE_CLIENT_ID" && env_var_is_defined "AZURE_TENANT_ID" && env_var_is_defined "AZURE_CLIENT_SECRET") && \ - ! env_var_is_defined "IDENTITY_ENDPOINT"; then - log_error "Azure Blob Storage ('abs://') requires at least one auth mechanism: 'LITESTREAM_AZURE_ACCOUNT_KEY', service-principal vars ('AZURE_CLIENT_ID', 'AZURE_TENANT_ID', 'AZURE_CLIENT_SECRET'), or managed identity ('IDENTITY_ENDPOINT')." - fi + env_var_is_defined "LITESTREAM_AZURE_ACCOUNT_KEY" \ + || { env_var_is_defined "AZURE_CLIENT_ID" && env_var_is_defined "AZURE_TENANT_ID" && env_var_is_defined "AZURE_CLIENT_SECRET"; } \ + || env_var_is_defined "IDENTITY_ENDPOINT" \ + || log_error "Azure Blob Storage ('abs://') requires at least one auth mechanism: 'LITESTREAM_AZURE_ACCOUNT_KEY', service-principal vars ('AZURE_CLIENT_ID', 'AZURE_TENANT_ID', 'AZURE_CLIENT_SECRET'), or managed identity ('IDENTITY_ENDPOINT')." ;; *) log_error "Invalid 'LITESTREAM_REPLICA_URL'. Must start with 's3://', 'abs://', or be set to 'DISABLED_I_KNOW_WHAT_IM_DOING'."