woodpecker grpc key and persistent agent id

clusters/base/apps/woodpecker/helmrelease.yaml

@@ -44,6 +44,7 @@ spec:
                 memory: 512Mi
       agent:
         replicas: 1
+        strategy: Recreate # RWO volume for agent id
         serviceAccount:
           name: woodpecker-agent # created in rbac.yaml
         pod:
@@ -105,3 +106,10 @@ spec:
           server:
             app:
               - path: /var/lib/woodpecker
+      agent-config:
+        type: persistentVolumeClaim
+        existingClaim: woodpecker-agent-config
+        advancedMounts:
+          agent:
+            app:
+              - path: /etc/woodpecker

clusters/base/apps/woodpecker/pvc.yaml

@@ -10,3 +10,16 @@ spec:
   resources:
     requests:
       storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: woodpecker-agent-config
+  namespace: ci
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi

clusters/base/apps/woodpecker/secret.enc.yaml

@@ -7,6 +7,7 @@ stringData:
     WOODPECKER_AGENT_SECRET: ENC[AES256_GCM,data:UyYPJpkHb2G1Vpe2tEtkNDMktp6zFbeNtDF34Kp8vf6nAY5/2EYXBJvT4+Ns2oOGNZOupdCUmTowrJ+ITNFwhQ==,iv:EtXILwt+FFYvqvLw9kLODh0wyhrHG+GJNGZRu6wzXd4=,tag:Ly5dsTWio741VxgtPy51XQ==,type:str]
     WOODPECKER_GITEA_CLIENT: ENC[AES256_GCM,data:hXBo5EwhHuCTQ4vQBAmjnLTlQ6cY2dKeJ5vZJ27wMFUsKZpS,iv:Pzt78GVSWngjVvpVSEgvsImK+siHEHOqQy+jOAxrGkc=,tag:JYu+Jf+n9J4L4LPwRPPbSw==,type:str]
     WOODPECKER_GITEA_SECRET: ENC[AES256_GCM,data:nu4FTBjdJe7oHx2Vt1ElxJXVnYzONC3kKYlXwvtmVI3/DokjSGA0YwLy0jI58l7K9nBbzGKuuZM=,iv:U6mfIG+LYhSfooIK3yhJay+fQh5oCNyGUggN+MrY4os=,tag:Oho0FnhePMLhFzsyhFISZQ==,type:str]
+    WOODPECKER_GRPC_SECRET: ENC[AES256_GCM,data:rLiZToTcqf03gY/psoboYUsDUC16/0ZPkgOo/5ABrOvuyvHFoJPnAlvYhvSu/+qCIU1vlv7AvhfEJyEig+ULaA==,iv:q42abGbWSQb1noVhkXwiAWoIXcDUT01MTbnhaV5Plos=,tag:gioDH0cIPGoRD4auPEq71w==,type:str]
 sops:
     age:
         - recipient: age13qwkssk8esashln2j3gfv6e9csashr4vddkdav5v38hm5wejl36qd2ew9s
@@ -18,7 +19,7 @@ sops:
             TXlXWjViSGNFb1FhQ0xDT0gvajdwSlEKXB7N64RmaWgCCSvG/nNWOziO7QnN729i
             jJLB6SPiHjgNMn1GP+rsAstVFStB0fn2mh6QpWrdhAM3/NFBqQfy7A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-10-07T08:19:00Z"
-    mac: ENC[AES256_GCM,data:MInWU0fjxmodXDN7x9U6rd2V2xCjty94Bb7Y0HlwJscaSmLR0jgkjTV0dYimPlyBfVhNlJzgmKcMj9ZvZOqxMKVive6L5Hghq5RXG2LKimWu5VyjffMabP9w3Edob+4prfT2EJ8rAY1OjuP00CiKc/958+ZoVYafN/hj4wqEmas=,iv:cpc2LcbdxJv0LenEA0W7TWLQSAMyCCEd/pHgxs9EUus=,tag:5dC2RKTm079OxgyG8aF3Ow==,type:str]
+    lastmodified: "2026-10-07T08:38:39Z"
+    mac: ENC[AES256_GCM,data:+beUA2t2YPqjsk7KXnPgJBiiQSjB7qypni669F2W3YNdTXx/ChenMxo7srjvejW3YfzPccbnBY6/TJgKCLPGm/Kf0hntejbBgYeu9hltSrIZX28efoE6tq4NicqJkPT8oD24v++H5jxRZP4epmef5t6rzJSq1xc4ETZerK0f9PU=,iv:wekT7WxL/Xm+vqCYCsZ4nvwl8VeOugURNvbHs/KQhRk=,tag:gH5efL/YUtJEewcY0G3Ctw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0