CI installed vault by shelling out to `dnf install vault -y`, which reads
metadata for every enabled repo (appstream/baseos/crb/epel/ha) and downloads
the 169MB vendored vault RPM from the unkin repo on every pipeline run
(~39s per plan/apply job).
- Replace the dnf install with a pinned curl of the upstream vault zip from
the artifactapi hashicorp-releases remote proxy, extracted with python3 to
/usr/local/bin/vault.
- Pin the version via a VAULT_VERSION env var (1.20.0).
terragrunt-enc will be the single source of truth for encapi ENC data
(statuses, roles, node classifications), managed via Terraform/Terragrunt,
superseding Cobbler classification for Puppet.
- Add config/git.unkin.net/unkin/repository/terragrunt-enc.yaml (public,
default_branch main, delete-branch-after-merge, squash merges).
- Protect main: block direct pushes, require the two Woodpecker PR status
checks (pre-commit, plan), and whitelist benvin for approvals.
The cephrgw-operator provisions Ceph RGW (S3) buckets and access keys from
Kubernetes CRDs via the Ceph manager dashboard API, and needs a Gitea repo
to host its code and run Woodpecker CI.
- Add config/git.unkin.net/unkin/repository/cephrgw-operator.yaml with the
standard public-repo settings (squash merge, delete branch on merge) and
main branch protection requiring the pre-commit/test/build PR checks.
2026-07-18 00:08:06 +10:00
9 changed files with 101 additions and 2 deletions
description:"Dependency-less Go CLI client for encapi, used as the Puppet exec External Node Classifier (ENC) on k8s compilers. Fetches the cobbler-wire ENC document and reshapes it for the puppet exec node_terminus."
description:"Merging HTTP proxy over two PuppetDB backends, presenting a single merged PuppetDB v4 query surface during the VM to k8s Puppet migration. Deployed in-cluster via argocd-apps."
description:"Single source of truth for encapi ENC data (statuses, roles, nodes), managed via Terraform/Terragrunt. Supersedes Cobbler node classification for Puppet."
description:"Fleet control plane for tomswall firewalls. Terraform-managed API that compiles fleet-wide zones, address groups, and firewall policy into per-device tomswall configs; agents pull and differentially apply."
private:false
default_branch:"main"
default_delete_branch_after_merge:true
default_merge_style:"squash"
branch_protection:
- rule_name:"main"
enable_push:false
status_check_contexts:
- "ci/woodpecker/pr/pre-commit"
- "ci/woodpecker/pr/test"
- "ci/woodpecker/pr/build"
approval_whitelist_users:
- "benvin"
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
unkinben
benvin
benvin