From 09ae9540853a8ba78a2d1add4735f55515600ce6 Mon Sep 17 00:00:00 2001 From: Hermes Agent service account Date: Fri, 29 May 2026 23:25:07 -0500 Subject: [PATCH] fix(semaphore/configure): template vault entry requires type='password' Semaphore v2.18 source (db/TemplateVault.go) shows FillTemplateVault only loads the key when type==TemplateVaultPassword. With type left as the default empty string, the vault key is stored but never materialised at task-run time; ansible-playbook gets no password and fails with 'Attempting to decrypt but no vault secrets found'. Confirmed by patching live templates via PUT with type='password'; next task run succeeded. --- ansible/roles/semaphore/tasks/configure.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ansible/roles/semaphore/tasks/configure.yml b/ansible/roles/semaphore/tasks/configure.yml index 713722a..c50fa3b 100644 --- a/ansible/roles/semaphore/tasks/configure.yml +++ b/ansible/roles/semaphore/tasks/configure.yml @@ -307,7 +307,8 @@ | combine( {'vaults': [{'id': 0, 'vault_key_id': _semaphore_key_ids[item.vault_password] | int, - 'name': 'default'}]} + 'name': 'default', + 'type': 'password'}]} if item.vault_password is defined else {} ) }}