Why:
- An audit for the new unkin-agent bot (org-wide write) found repos with
no branch_protection at all, so the agent (or anyone with write) could
push straight to their default branch.
- The rest of the estate protects default branches; these repos were the gap.
How:
- Add enable_push: false + approval_whitelist_teams: Owners on each active
repo's default branch, matching the estate's most common convention
(PR-only; Owners can still open and approve).
- Omit status checks on these repos as none run CI, so a required context
would permanently block merges.
- Leave the 8 archived repos untouched: they are read-only, nothing can push
to them, and branch-protection creation on archived repos is rejected.
Scope grew beyond IPAM (devices, provisioning). Renaming the config file renames
the managed repo; the gitea provider archives the old terraform-ipam repo
(archive_on_destroy=true) and creates terraform-infra. terraform-ipam only holds an
auto-init README, so nothing is lost.
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
Provision the Gitea repo for a generic app-token Vault/OpenBao secrets
engine that issues short-lived signed JWTs for self-made services,
replacing per-app static bearer Secrets. Mirrors the existing plugin repo
entries (squash-only, main branch protection, PR CI checks).
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
Provision the repo for the new Kea DHCP Kubernetes operator that replaces
the ISC dhcpd PXE-boot VM.
- add config/git.unkin.net/unkin/repository/kea-operator.yaml
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
bootapi-images builds the AlmaLinux node rootfs tarballs that bootapi's
image-based provisioning (liveimg) unpacks, and on a v* tag publishes
almalinux9-node-<ver>.tar.zst to the artifactapi rootfs-images local repo. Split
out of bootapi-templates so that repo stays templates-only.
Modeled on the bootapi-templates entry: public, squash, delete-branch-after-merge,
main protection requiring the pre-commit + lint Woodpecker checks and benvin
approval.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
bootapi-templates holds the live kickstart/iPXE templates and the distro catalog
that bootapi pulls via git-sync (every ~3m, like argocd), so template/OS changes
ship without rebuilding bootapi. Its CI validates that every template parses and
renders for every catalog distro (via 'bootapi validate') plus shellcheck on the
%post snippets.
Modeled on the bootapi repo entry: public, squash, delete-branch-after-merge,
main protection requiring the pre-commit + validate Woodpecker checks and benvin
approval.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
bootapi is a Go service replacing Cobbler's PXE/kickstart side: it renders
kickstart files and iPXE boot scripts from NetBox data and serves them to
PXE-booting hosts. The ENC half already moved to encapi; bootapi covers the
provisioning/boot half.
Adds config/git.unkin.net/unkin/repository/bootapi.yaml modeled on encapi:
public repo, squash merges, delete-branch-after-merge, main branch protection
requiring the pre-commit/test/build Woodpecker checks and benvin approval.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Registers the logarchiver Gitea repo: a k8s Go service that archives
raw logs from NATS JetStream to S3 as zstd-compressed, GPG-encrypted,
indexed objects, plus a CLI to search and retrieve them. It replaces the
Vector archiver leg of the centralized logging stack (argocd-apps #296)
with zstd compression, OpenPGP encryption keyed from the Vault GPG
secrets engine, and a ClickHouse-backed searchable index.
- Add config/git.unkin.net/unkin/repository/logarchiver.yaml modeled on
the existing Go-service repos (encapi, cephrgw-operator): public repo,
main default branch, squash merges, branch protection requiring the
woodpecker pre-commit/test/build PR checks with benvin approval.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Why: the vault-plugin-secrets-gitea engine needs a purpose-built Gitea
site-admin credential to mint and delete per-user tokens. Provision that
account and its Vault seed here so the credential is generated once and never
exposed. Ben asked that the password be written to Vault exactly once and
never updated afterwards.
Change:
- Add config/git.unkin.net/user/gitea-vault-admin.yaml: a local site-admin bot
(admin: true, limited visibility, no org/repo creation).
- Extend the user module with an optional vault_seed_path/vault_seed_mount: when
set, write the account's generated password to Vault KV as admin_username and
admin_password via vault_kv_secret_v2, with lifecycle ignore_changes on
data_json so the write is create-only and never churns (random_password
already never regenerates). This keeps the seed stable and prevents a re-apply
from overwriting a password later rotated out-of-band by rotate-root.
- Add the hashicorp/vault provider (module plus root generate block); it reads
VAULT_ADDR and VAULT_TOKEN already exported by the Makefile k8s login.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Add a data-driven 'user' config kind so Gitea accounts are declared as
config/git.unkin.net/user/<name>.yaml, mirroring the existing repository
and team kinds. Wire the yaml into a new modules/user submodule that
creates a gitea_user (provider go-gitea/gitea 0.7.0, already pinned).
The provider's user resource requires a password; generate a per-user
random_password so nothing sensitive is hardcoded and only a placeholder
lives in state (tokens come later from vault-plugin-secrets-gitea).
Provision teabot's implementer and reviewer personality accounts with a
conservative posture: not site admins, no org creation, no repo creation,
limited profile visibility.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Create the Gitea repositories for the new vault-plugin-secrets-gitea
secrets engine and its companion terraform-provider-giteavaultsecret,
mirroring the rancher pair's settings.
- add config/git.unkin.net/unkin/repository/vault-plugin-secrets-gitea.yaml
- add config/git.unkin.net/unkin/repository/terraform-provider-giteavaultsecret.yaml
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
CI installed vault by shelling out to `dnf install vault -y`, which reads
metadata for every enabled repo (appstream/baseos/crb/epel/ha) and downloads
the 169MB vendored vault RPM from the unkin repo on every pipeline run
(~39s per plan/apply job).
- Replace the dnf install with a pinned curl of the upstream vault zip from
the artifactapi hashicorp-releases remote proxy, extracted with python3 to
/usr/local/bin/vault.
- Pin the version via a VAULT_VERSION env var (1.20.0).
terragrunt-enc will be the single source of truth for encapi ENC data
(statuses, roles, node classifications), managed via Terraform/Terragrunt,
superseding Cobbler classification for Puppet.
- Add config/git.unkin.net/unkin/repository/terragrunt-enc.yaml (public,
default_branch main, delete-branch-after-merge, squash merges).
- Protect main: block direct pushes, require the two Woodpecker PR status
checks (pre-commit, plan), and whitelist benvin for approvals.
The cephrgw-operator provisions Ceph RGW (S3) buckets and access keys from
Kubernetes CRDs via the Ceph manager dashboard API, and needs a Gitea repo
to host its code and run Woodpecker CI.
- Add config/git.unkin.net/unkin/repository/cephrgw-operator.yaml with the
standard public-repo settings (squash merge, delete branch on merge) and
main branch protection requiring the pre-commit/test/build PR checks.
unkinben
benvin
benvin