passv (a Vault-backed drop-in for pass) needs a Gitea repo to hold its source
and run its Woodpecker PR/release pipelines.
- Add config/git.unkin.net/unkin/repository/passv.yaml (public, main default
branch, squash-only, main branch protection gated on the pre-commit/build/test
PR checks), mirroring the sibling vault-plugin-secrets-gpg repo.
Creates the two Gitea repositories backing the new Rancher token secrets engine:
a Vault/OpenBao plugin and its Terraform provider.
- Add config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml
(squash-only, main protected on pre-commit/build/test).
- Add config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml
(same protection profile as the litellm provider repo).
Provision the terraform-rancher Gitea repo, which will manage Rancher's
Authentik OIDC auth (keycloakoidc AuthConfig) via the rancher2 provider,
mirroring the terraform-authentik pattern.
The GPG/OpenPGP secrets engine needs a Gitea repo to hold its source and run
its Woodpecker PR/release pipelines.
- Add config/git.unkin.net/unkin/repository/vault-plugin-secrets-gpg.yaml
(public, main default branch, squash-only, main branch protection gated on
the pre-commit/build/test PR checks), mirroring the sibling
vault-plugin-secrets-bind-tsig repo.
Register a new public repo to host benvin-utils, a monorepo of small
single-purpose CLI tools (first tool: podgap) that share a common Go library.
- Add config/git.unkin.net/unkin/repository/benvin-utils.yaml (main default branch, delete branch after merge)
Declares the repo for a HashiCorp Vault / OpenBao secrets engine that
manages BIND TSIG keys via the bind-operator (static rotation + dynamic
creds). Mirrors the vault-plugin-secrets-litellm repo config.
Adds the Gitea repository that manages the Docker container build for the
jellyfin-ha (HA transcoding) Jellyfin fork.
- Create unkin/jellyfin-ha (public, squash merges, delete branch on merge)
- Protect main; require the ci/woodpecker/pr/build check and docker-team approval
Create the two Gitea repos backing the new Puppet ENC that replaces Cobbler:
- encapi: Go API + encapi-cli, Postgres-backed
- terraform-provider-encapi: Terraform provider for ENC roles/statuses/nodes
Both use main as default branch with squash-merge, delete-branch-after-merge,
and branch protection gated on the PR pipelines (pre-commit, test, build).
Merged PR branches should be cleaned up automatically everywhere, for a
consistent workflow across the estate.
- Flip default_delete_branch_after_merge from false to true on the 10 repos
that had it disabled.
- Add default_delete_branch_after_merge: true to the 3 repos that were missing
the field (terraform-git, terraform-provider-litellmvaultsecret,
vault-plugin-secrets-litellm).
node-lookup is being set up with build/test/pre-commit CI and a main-based
workflow, so its Gitea repo config needs to match.
- Change default_branch from master to main.
- Rename the branch protection rule to main and update the required status
checks to the new pipeline names (build, test, pre-commit) instead of the
old lint/unit-tests contexts.
Declares the bind-operator repo so Gitea provisions it for the new
Kubernetes operator that manages BIND9 DNS clusters.
- add config/git.unkin.net/unkin/repository/bind-operator.yaml with
main as default branch, squash merge, delete-branch-after-merge, and
branch protection requiring the pre-commit/test/build CI checks
Provision two new Gitea repos for the LiteLLM dynamic secrets work: the
Vault/OpenBao secrets-engine plugin and its companion Terraform provider.
- Add config/.../repository/vault-plugin-secrets-litellm.yaml
- Add config/.../repository/terraform-provider-litellm.yaml
- Default branch main, squash-only merging (allow_* flags, since the
go-gitea/gitea provider has no default_merge_style), and branch protection
on main requiring pre-commit/build/test checks with Owners approval
- Remove woodpecker_repository module and provider (repos managed outside TF)
- Add removed block with destroy=false to drop state without destroying
- Add module.team to branch_protection depends_on to prevent race condition
- Add lifecycle ignore_changes for team permission (provider bug: API returns
"none" but rejects it on write)
benvin
unkinben
Ben Vincent