p24-infra Docs

discord-bot-decommission

4 min read

Discord Bot Decommission Playbook

Scope: Retire DISCORD_BOT_TOKEN and the legacy Discord-poll path after the Alertmanager → n8n direct webhook bridge (issue #1960) is verified in production.

Prerequisite: The alertmanager-to-gh-comment n8n workflow (id aR156ACui4i6lqgE, webhook path alertmanager-worker-failure) must be imported, active on bms-4, AND verified (at least one real or test alert has produced a GitHub comment within 30s).

Step 1 — Retire the legacy Discord-poll path in n8n

The bridge workflow was transformed in place by #1960: the old discord-alert-to-gh-comment workflow (id aR156ACui4i6lqgE) was renamed alertmanager-to-gh-comment and its three Discord-poll nodes (Schedule, Fetch Discord Messages, Parse Discord Alerts) were removed, so importing the updated JSON already retires the polling path.

  1. Open n8n on bms-4: https://n8n.bms-4.infra.zintegrowana.online
  2. Navigate to Workflows and open alertmanager-to-gh-comment (id aR156ACui4i6lqgE).
  3. Confirm it no longer contains the Schedule / Fetch Discord Messages / Parse Discord Alerts nodes (import bms-4/n8n-workflows/alertmanager-to-gh-comment.json if the live copy is stale).
  4. Confirm no active executions reference the Discord poll (check Executions tab).

Step 2 — Audit monitoring.env.sops for DISCORD_BOT_TOKEN usage

Confirm no other active workflow or service references DISCORD_BOT_TOKEN:

# Decrypt and check key existence (count only — never print the value)
sops --decrypt --input-type dotenv --output-type dotenv `
  C:\code_2026\p24-infra\secrets\monitoring.env.sops `
  | Select-String "DISCORD_BOT_TOKEN" | Measure-Object -Line

Also check n8n credentials UI: Settings → Credentials — search for any credential named Discord Bot Token or similar. If used by another active workflow, defer decommission.

Step 3 — Remove DISCORD_BOT_TOKEN from monitoring.env.sops

Windows SOPS edit procedure (LF + no-BOM required):

# 1. Decrypt to temp file
$tmp = "C:\code_2026\p24-infra\secrets\_edit_monitoring.env.sops"
sops --decrypt --input-type dotenv --output-type dotenv `
  C:\code_2026\p24-infra\secrets\monitoring.env.sops | `
  Where-Object { $_ -notmatch "^DISCORD_BOT_TOKEN=" } | `
  Out-String | ForEach-Object { $_.TrimEnd("`r") } | Set-Variable -Name content
 
[System.IO.File]::WriteAllText($tmp, $content, [System.Text.UTF8Encoding]::new($false))
 
# 2. Re-encrypt in place
sops --encrypt --input-type dotenv --output-type dotenv $tmp > `
  C:\code_2026\p24-infra\secrets\monitoring.env.sops
Remove-Item $tmp
 
# 3. Canary decrypt to verify
sops --decrypt --input-type dotenv --output-type dotenv `
  C:\code_2026\p24-infra\secrets\monitoring.env.sops | Out-Null
if ($LASTEXITCODE -ne 0) { throw "SOPS corrupt — do NOT commit. See docs/playbooks/sops-windows-crlf.md" }
Write-Host "Canary passed — safe to commit"

Recovery if SOPS corrupt: docs/playbooks/sops-windows-crlf.md

Step 4 — Remove DISCORD_BOT_TOKEN from GitHub Secrets

gh secret delete DISCORD_BOT_TOKEN --repo radieu/p24-infra

Verify removal:

gh secret list --repo radieu/p24-infra | Select-String "DISCORD"

Step 5 — Revoke the token in Discord Developer Portal

  1. Open: https://discord.com/developers/applications/1501737509896323072
  2. Navigate to Bot tab.
  3. Click Reset Token to revoke the current token (or delete the bot application if Discord bot functionality is no longer needed at all).
  4. If other workflows need Discord webhooks (for embed notifications), those use Discord webhook URLs (not the bot token) — those are unaffected by this step.

Step 6 — Commit and deploy

cd C:\code_2026\p24-infra
git add secrets/monitoring.env.sops
git commit -m "security: remove DISCORD_BOT_TOKEN (decommissioned per #1960)"
# Push to feature branch, open PR → main

On vps-i1, after PR is merged and deployed:

# Redeploy monitoring stack to pick up env change
cd /opt/p24-infra/monitoring
docker compose up -d --env-file .env

Verification

  • n8n alertmanager-to-gh-comment workflow no longer contains the Discord-poll nodes
  • No active n8n workflow references DISCORD_BOT_TOKEN in credentials
  • monitoring.env.sops no longer contains DISCORD_BOT_TOKEN key
  • GH Secret removed: gh secret list --repo radieu/p24-infra | Select-String "DISCORD" returns nothing
  • Token revoked in Discord Developer Portal
  • alertmanager-to-gh-comment workflow continues to fire correctly

Escalation

If the alertmanager-to-gh-comment workflow stops working after decommission:

  • Check n8n workflow is Active on bms-4
  • Check Alertmanager is sending to the alertmanager-worker-failure endpoint: amtool alert query on vps-i1
  • Check n8n execution log for errors in the Post GH Comment node
  • Fallback: revert the alertmanager worker-failure-gh receiver and open a bug issue in radieu/p24-infra (Discord embeds continue to deliver via the existing email / n8n-incident receivers regardless)

Graph View