unkinben
34c2994cd3
Per the forge design: drop git-over-ssh (HTTPS clones only, estate norm) and serve the new instance on both the canonical git.unkin.net and a git.k8s.syd1.au.unkin.net admin/backup route (same dual-name pattern as identity). Only the k8s admin name goes live now (external-dns); the git.unkin.net DNS flip stays the gated final cutover step. - values: DISABLE_SSH + START_SSH_SERVER false; DOMAIN/ROOT_URL/SSH_DOMAIN -> git.unkin.net; drop the SSH LoadBalancer service - overlay: $patch-delete the chart's leftover gitea-ssh Service - gateway/httproute: listeners + routes for git.unkin.net and git.k8s.syd1.au.unkin.net; cert CN git.unkin.net (both as SANs); external-dns publishes only git.k8s.syd1.au.unkin.net -> 198.18.200.4 - bind-internal: prepared (commented) git-dns-internal DNSRecord as the gated apex cutover step - docs: SSH removed, dual hostnames, git.unkin.net flip as the final step Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |
| authentik-rancher-sso.md | Manual runtime step to point Rancher's OIDC auth at the canonical identity.unkin.net issuer and trust the internal CA. |
| gitea-migration.md | Staged cutover of the git.unkin.net forge from the Puppet VM to the gitea namespace. |