unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Gitea git.unkin.net production cutover (VM forge -> k8s) #321

New Issue
Open
opened 2026-08-02 16:24:31 +10:00 by unkinben · 0 comments
unkinben commented 2026-08-02 16:24:31 +10:00
Owner
Copy Link
Copy Source

Problem
The k8s Gitea (ns gitea) is deployed, HA-healthy, SSH-off, OIDC-wired, reachable at git.k8s.syd1.au.unkin.net. The production forge git.unkin.net still serves off the Puppet VM. Cutover is the remaining, gated step (new instance is empty).

Proposal

  • rehearse: gitea dump on the VM (repos+DB+LFS+attachments) -> restore into the k8s CNPG instance; copy the VM app.ini SECRET_KEY/INTERNAL_TOKEN so restored encrypted columns decrypt
  • freeze window: final dump/restore, flip gitea ROOT_URL back to git.unkin.net, add git.unkin.net to the gateway cert SAN, flip the git.unkin.net DNS record (currently the Puppet-zone HAProxy VIP) to 198.18.200.4
  • verify consumers: woodpecker forge (forge_remote_id stability needs a full SQL restore), tea, terraform-git provider, teabot, argocd repo creds, the gitea vault engine admin API, r10k
  • rollback: DNS back to the VM (untouched)

Acceptance

  • git.unkin.net serves the k8s instance with all repos/LFS/history; woodpecker webhooks + all consumers verified; rollback path proven.
**Problem** The k8s Gitea (ns gitea) is deployed, HA-healthy, SSH-off, OIDC-wired, reachable at git.k8s.syd1.au.unkin.net. The production forge git.unkin.net still serves off the Puppet VM. Cutover is the remaining, gated step (new instance is empty). **Proposal** - rehearse: gitea dump on the VM (repos+DB+LFS+attachments) -> restore into the k8s CNPG instance; copy the VM app.ini SECRET_KEY/INTERNAL_TOKEN so restored encrypted columns decrypt - freeze window: final dump/restore, flip gitea ROOT_URL back to git.unkin.net, add git.unkin.net to the gateway cert SAN, flip the git.unkin.net DNS record (currently the Puppet-zone HAProxy VIP) to 198.18.200.4 - verify consumers: woodpecker forge (forge_remote_id stability needs a full SQL restore), tea, terraform-git provider, teabot, argocd repo creds, the gitea vault engine admin API, r10k - rollback: DNS back to the VM (untouched) **Acceptance** - git.unkin.net serves the k8s instance with all repos/LFS/history; woodpecker webhooks + all consumers verified; rollback path proven.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#321
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?