terraform-infra was scoped to NetBox plus Kea DHCP, but Kea is managed by
the kea-operator CRDs in argocd-apps; the two declare the same subnets and
would fight. The repo is narrowed to the NetBox side and renamed to match.
- add the terraform-netbox repository (squash-only, Owners-gated, pre-commit
and plan required)
- remove terraform-infra
Neither repo has a test workflow, so the required ci/woodpecker/pr/test
context never reports and every PR stays permanently unmergeable.
- Remove ci/woodpecker/pr/test from status_check_contexts on both repos
- Keep ci/woodpecker/pr/build and ci/woodpecker/pr/pre-commit
Add a pull mirror of github.com/9p4/jellyfin-plugin-sso into the mirrors
organisation, syncing every 8h with issues, pull requests and release
migration disabled.
Host the Go rewrites of the certmanager and sshsignhost Vault signing
helpers.
- Add config/git.unkin.net/unkin/repository/puppet-vault-signers.yaml
- Protect main with Owners-only merge and the standard woodpecker checks
Defense in depth for the repo-creation bot: a restricted Gitea account can
only see repositories and organisations it is explicitly added to, so a
leaked repospawner token cannot enumerate or read the rest of the estate.
The repospawner team grant on terraform-git already covers everything the
bot does, so nothing it needs is lost.
repospawner opens repo-creation PRs against terraform-git and needs no other
access, so give it its own identity and a per-repo team instead of adding it to
the org-wide agents team.
- add config/git.unkin.net/user/repospawner.yaml (limited visibility, not admin,
no org/repo creation), mirroring the unkin-agent bot posture
- add config/git.unkin.net/unkin/team/repospawner.yaml granting write on the
terraform-git repository only (include_all_repositories false)
The terraform-nomad project is being decommissioned; mark it archived
in Gitea so it becomes read-only, consistent with other retired repos
in this config (e.g. rpmbuild-template).
Both repos do not need to be private, and their main branches should
only accept PRs whose Woodpecker pipeline passed.
- private: false for clickhouse-tools and logviewer
- require ci/woodpecker/pr/build status check on main for both
The waitfordb CI is being split into three Woodpecker PR workflows
(pre-commit, test, build), each exposing its own status context. Require
all three on the main branch protection so a PR cannot merge until
pre-commit, test, and build all pass. Mirrors node-lookup.
Owners-only merge, benvin approval, and the required Woodpecker PR check.
Requires the repo to be activated in Woodpecker so ci/woodpecker/pr/build
reports before a PR can merge.
waitfordb is a small Go tool shipped as a container image, used as a Kubernetes
initContainer to block an app from starting until its database is ready. It
replaces the hand-written psql-in-a-shell init steps on the arrstack.
Creates the unkin/waitfordb Gitea repo (Go tool settings mirroring node-lookup:
public, squash merges, delete branch after merge). branch_protection is omitted
on creation to avoid requiring Woodpecker status checks that do not exist until
the first pipeline runs; it will be added in a follow-up PR once CI is green.
terraform-provider-arrstackvaultsecret is a bespoke Terraform provider that
configures the new arrstack Vault/OpenBao secrets engine (engine config +
roles) from terraform-vault, following the per-engine-provider convention
used by the gpg/litellm/rancher vault-secret providers. It needs a Gitea
repo to host its source before CI and releases can be wired up.
- add config/git.unkin.net/unkin/repository/terraform-provider-arrstackvaultsecret.yaml
- public repo, default branch main, delete-branch-after-merge, squash-only
- Owners-only merge with required pre-commit/build/test Woodpecker checks
vault-plugin-secrets-arrstack is a new Vault/OpenBao secrets engine that
dynamically mints arrproxy machine (per-user) API tokens, enabling
terraform-driven onboarding of *arr services. It needs a Gitea repo to
host its source before CI and releases can be wired up.
- add config/git.unkin.net/unkin/repository/vault-plugin-secrets-arrstack.yaml
- public repo, default branch main, delete-branch-after-merge, squash-only
- Owners-only merge with required pre-commit/build/test Woodpecker checks
benvin
unkin-agent
unkin-agent