Merge pull request 'Drop ci/woodpecker/pr/test status check from container-base and container-gobuilder' (#104) from container-protection-test-context into main

Reviewed-on: #104

Makefile

@@ -23,7 +23,7 @@ init:
 
 plan: init
 	@$(call vault_env) && \
-	terragrunt run --all --parallelism 4 --non-interactive plan
+	terragrunt run --all --parallelism 4 --non-interactive plan -- -lock=false
 
 apply-if-changes: init
 	@$(call vault_env) && \

config/git.unkin.net/mirrors/config.yaml

@@ -0,0 +1,3 @@
+description: "Pull mirrors of upstream repositories"
+visibility: public
+repo_admin_change_team_access: true

config/git.unkin.net/mirrors/repository/jellyfin-plugin-sso.yaml

@@ -0,0 +1,11 @@
+description: "Pull mirror of github.com/9p4/jellyfin-plugin-sso, the Jellyfin SSO/OIDC authentication plugin"
+private: false
+has_issues: false
+has_pull_requests: false
+mirror: true
+migration_clone_address: "https://github.com/9p4/jellyfin-plugin-sso"
+migration_service: "git"
+migration_mirror_interval: "8h0m0s"
+migration_issue_labels: false
+migration_milestones: false
+migration_releases: false

config/git.unkin.net/unkin/repository/agent-tools.yaml

@@ -0,0 +1,16 @@
+description: "CLI tools for orchestrator PR automation as unkin-agent"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/app-sudaporn-research-individual.yaml

@@ -2,3 +2,8 @@ description: "Sudaporn's Research Data visualisation, normalised "
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/app-sudaporn-research-normalised.yaml

@@ -2,3 +2,8 @@ description: "Sudaporn's Research Data visualisation, normalised"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/argocd-apps.yaml

@@ -4,10 +4,11 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"
       - "ci/woodpecker/pr/kubeconform"
-      - "ci/woodpecker/pr/vector-test"
     approval_whitelist_users:
       - "benvin"

config/git.unkin.net/unkin/repository/arrproxy.yaml

@@ -0,0 +1,16 @@
+description: "arrstack reverse proxy: oauth2-gated UI + per-user API-key broker"
+private: true
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/arti-pack.yaml

@@ -0,0 +1,14 @@
+description: "Neovim plugin manager that installs plugins from tagged archives in an HTTP artifact repository into nvim's native package path"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/lint"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/artifactapi.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "master"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/autobackup-operator.yaml

@@ -0,0 +1,16 @@
+description: "Kubernetes operator that provisions S3 buckets and backup schedules from backups.unkin.net/* annotations on PVCs and CNPG clusters"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/benvin-utils.yaml

@@ -2,3 +2,8 @@ description: "Monorepo of small single-purpose CLI tools sharing a common librar
 private: false
 default_branch: "main"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/bind-operator.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/bootapi-images.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/bootapi-templates.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/bootapi.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/cephrgw-operator.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/certmanager.yaml

@@ -1,4 +1,4 @@
-description: "Vault PKI certificate issuance and SSH host key signing tool for Puppet-managed infrastructure"
+description: "Vault-backed X.509 certificate signing helper for Puppet"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true

config/git.unkin.net/unkin/repository/clickhouse-tools.yaml

@@ -0,0 +1,14 @@
+description: "CLI tools (chcat, chtail, chgrep) for searching, filtering and tailing logs in the ClickHouse log store"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/container-agent-base.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/container-agent-dev.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/container-agent-infra.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/container-base.yaml

@@ -0,0 +1,15 @@
+description: "Base container images for the estate, carrying internal CA trust and dnf/repo configuration, built as a matrix across the supported distros."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/container-devcompute.yaml

@@ -1,3 +1,8 @@
 description: "Docker image to be used in Kubernetes as a developers container"
 private: false
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/container-gobuilder.yaml

@@ -0,0 +1,15 @@
+description: "Go toolchain builder container image, built on each supported container-base distro image, used by Woodpecker pipelines to compile Go projects."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/dns-updater.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/docker-template.yaml

@@ -3,3 +3,8 @@ private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
 repo_template: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/encapi.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/encapic.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/ghp.yaml

@@ -0,0 +1,17 @@
+description: "Fork of goodtune/ghp (GitHub proxy) with unkin patches"
+private: true
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    # Whitelist-push: the owner can push main directly (needed for the initial
+    # push and the fork's maintenance workflow); everyone else must open a PR.
+    enable_push: true
+    push_whitelist_users:
+      - "unkinben"
+    # PRs to main must pass the fork build/vet pipeline before merge.
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/go-cache-plugin.yaml

@@ -0,0 +1,16 @@
+description: "Build repo that compiles the tailscale/go-cache-plugin GOCACHEPROG S3 Go build cache from a pinned upstream module version and publishes static binaries as Gitea releases."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/golib.yaml

@@ -0,0 +1,14 @@
+description: "Shared Go library for estate services: postgres, http service kit, vault and gitea clients"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/initbuilder.yaml

@@ -1,3 +1,8 @@
 description: "A repository for building initrd.img in docker "
 private: false
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/jellyfin-ha-src.yaml

@@ -0,0 +1,11 @@
+description: "Source fork of ZoltyMat/jellyfin-ha carrying HA patches"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/ci"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/jellyfin-ha.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/jellyfin-plugin-sso.yaml

@@ -0,0 +1,15 @@
+fork_from: "mirrors/jellyfin-plugin-sso"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    # Whitelist-push: the owner pushes main directly when syncing upstream;
+    # everyone else must open a PR.
+    enable_push: true
+    push_whitelist_users:
+      - "unkinben"
+    # PRs to main must pass the plugin build pipeline before merge.
+    status_check_contexts:
+      - "ci/woodpecker/pr/ci"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/kea-operator.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/logarchiver.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/logviewer.yaml

@@ -0,0 +1,14 @@
+description: "Web UI for the ClickHouse log store: fuzzy find, tail and SQL-filter logs (logviewer.unkin.net)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/mediamark.yaml

@@ -0,0 +1,14 @@
+description: "Keyboard-centric web UI to mark media as cheeztv (kids) content via hardlinks; oauth2-proxy fronted, talks to sonarr/radarr APIs"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/mediamover.yaml

@@ -0,0 +1,10 @@
+description: "Media copy/move tool: Go API + UI spawning per-file k8s Jobs from mediafs CephFS to media PVCs; doubles as a Ceph aggregate-bandwidth test"
+private: true
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false

config/git.unkin.net/unkin/repository/node-lookup.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/openbao.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     # Whitelist-push: the owner can push main directly (needed for the initial
     # push and the fork's maintenance workflow); everyone else must open a PR.
     enable_push: true

config/git.unkin.net/unkin/repository/passv.yaml

@@ -10,6 +10,8 @@ allow_rebase_explicit: false
 allow_squash_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/pdbmux.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/plugin-docker-buildx.yaml

@@ -0,0 +1,14 @@
+description: "Woodpecker plugin-docker-buildx image with the internal Vault-PKI CA baked in (trusts artifactapi)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "docker"

config/git.unkin.net/unkin/repository/prowlarr.yaml

@@ -0,0 +1,16 @@
+description: "Private fork of Prowlarr: Postgres backend + stateless multi-replica for the arrstack"
+private: true
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    # Owner can push main directly for fork maintenance (upstream-fix merges);
+    # everyone else opens a PR that must pass the Woodpecker image build.
+    enable_push: true
+    push_whitelist_users:
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/docker"

config/git.unkin.net/unkin/repository/puppet-catalog-tools.yaml

@@ -0,0 +1,14 @@
+description: "Go CLIs to diff Puppet catalogs between branches and map puppet-prod changes to affected hosts"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/puppetapi.yaml

@@ -2,3 +2,8 @@ description: "A fastapi service to present puppet services via an api"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/radarr.yaml

@@ -0,0 +1,16 @@
+description: "Private fork of Radarr: Postgres backend + stateless multi-replica for the arrstack"
+private: true
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    # Owner can push main directly for fork maintenance (upstream-fix merges);
+    # everyone else opens a PR that must pass the Woodpecker image build.
+    enable_push: true
+    push_whitelist_users:
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/docker"

config/git.unkin.net/unkin/repository/repospawner.yaml

@@ -0,0 +1,14 @@
+description: "API service that opens terraform-git PRs for new repo requests via kube Jobs; oauth2-proxy'd status UI"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/rpmbuild-internal-ca-certificates.yaml

@@ -2,3 +2,8 @@ description: "Package the internal ca-certificates"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/sonarr.yaml

@@ -0,0 +1,16 @@
+description: "Private fork of Sonarr: Postgres backend + stateless multi-replica for the arrstack"
+private: true
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    # Owner can push main directly for fork maintenance (upstream-fix merges);
+    # everyone else opens a PR that must pass the Woodpecker image build.
+    enable_push: true
+    push_whitelist_users:
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/docker"

config/git.unkin.net/unkin/repository/sshsignhost.yaml

@@ -0,0 +1,14 @@
+description: "Vault-backed SSH host certificate signing helper for Puppet"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/streamstack.yaml

@@ -1,3 +1,8 @@
 description: "A stack of microservices that aim to offer a distributed streaming service."
 private: false
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/teabot.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/terraform-git.yaml

@@ -4,6 +4,8 @@ default_branch: "main"
 default_delete_branch_after_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/terraform-infra.yaml

@@ -0,0 +1,16 @@
+description: "YAML-driven Terraform for NetBox IPAM, networks, and devices + Kea DHCP"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "benvin"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-nomad.yaml

@@ -2,6 +2,7 @@ description: "Manage nomad with Terraform"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+archived: true
 branch_protection:
   - rule_name: "master"
     enable_push: false

config/git.unkin.net/unkin/repository/terraform-provider-artifactapi.yaml

@@ -3,6 +3,8 @@ private: false
 default_delete_branch_after_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/terraform-provider-encapi.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/terraform-provider-giteavaultsecret.yaml

@@ -10,6 +10,8 @@ allow_rebase_explicit: false
 allow_squash_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/terraform-provider-gpgvaultsecret.yaml

@@ -10,6 +10,8 @@ allow_rebase_explicit: false
 allow_squash_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/terraform-provider-kea.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/terraform-provider-litellmvaultsecret.yaml

@@ -10,6 +10,8 @@ allow_rebase_explicit: false
 allow_squash_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml

@@ -10,6 +10,8 @@ allow_rebase_explicit: false
 allow_squash_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/terraform-provider-tomswallapi.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/terraform-provider-vault-secrets-arrstack.yaml

@@ -0,0 +1,21 @@
+description: "Terraform provider to manage the arrstack Vault secrets engine (config + roles)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-provider-vault-secrets-ghp.yaml

@@ -0,0 +1,21 @@
+description: "Terraform provider for the Vault/OpenBao ghp token secrets engine (vault-secrets-ghp)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-provider-vault-secrets-netbox.yaml

@@ -0,0 +1,21 @@
+description: "Terraform provider for the Vault/OpenBao NetBox token secrets engine (pairs with vault-plugin-secrets-netbox)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terragrunt-enc.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/tomswall.yaml

@@ -5,4 +5,6 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false

config/git.unkin.net/unkin/repository/tomswallapi.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-apptoken.yaml

@@ -0,0 +1,21 @@
+description: "HashiCorp Vault / OpenBao secrets engine issuing short-lived signed JWT app tokens (per-app roles, offline JWKS validation) for self-made services"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-arrstack.yaml

@@ -0,0 +1,21 @@
+description: "Vault/OpenBao secrets engine minting dynamic arrproxy per-user API tokens"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-bind-tsig.yaml

@@ -10,6 +10,8 @@ allow_rebase_explicit: false
 allow_squash_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-ghp.yaml

@@ -0,0 +1,21 @@
+description: "HashiCorp Vault / OpenBao secrets engine for ghp: mints ephemeral, scoped access tokens via the ghp admin API, authenticating as a static admin service token"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-gitea.yaml

@@ -10,6 +10,8 @@ allow_rebase_explicit: false
 allow_squash_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-gpg.yaml

@@ -10,6 +10,8 @@ allow_rebase_explicit: false
 allow_squash_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-litellm.yaml

@@ -10,6 +10,8 @@ allow_rebase_explicit: false
 allow_squash_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-netbox.yaml

@@ -0,0 +1,21 @@
+description: "HashiCorp Vault / OpenBao secrets engine for NetBox API tokens (seeded admin + dynamic per-user tokens with expiry-aligned leases)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml

@@ -10,6 +10,8 @@ allow_rebase_explicit: false
 allow_squash_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/vault-tools.yaml

@@ -5,6 +5,8 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/vimpack.yaml

@@ -0,0 +1,14 @@
+description: "Neovim plugin manager installing plugins from tagged archives on artifactapi/Artifactory instead of git clones"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/lint"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/waitfordb.yaml

@@ -0,0 +1,16 @@
+description: "A small Go tool, shipped as a container image, used as a Kubernetes initContainer to block an app from starting until its database is ready."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/team/agents.yaml

@@ -0,0 +1,14 @@
+# Grants the unkin-agent bot Write across every unkin repository so Ben's AI
+# coding agents can push benvin/* branches and open pull requests. Write is the
+# minimum Gitea permission that allows pushing branches + creating PRs.
+#
+# Merge stays reserved for Ben: branch protection on every default branch sets a
+# merge whitelist of the Owners team only, so members of this team can push and
+# open PRs but cannot merge or approve. Keep this team out of every merge and
+# approval whitelist.
+description: "AI coding agents -- push branches + open PRs, never merge"
+permission: write
+include_all_repositories: true
+can_create_repos: false
+members:
+  - unkin-agent

config/git.unkin.net/unkin/team/repospawner.yaml

@@ -0,0 +1,16 @@
+# Least-privilege access for the repospawner bot: Write on terraform-git only,
+# which is the minimum Gitea permission that allows pushing a branch and opening
+# a pull request. repospawner does its whole job here (repo-creation PRs), so it
+# is kept out of the org-wide "agents" team (include_all_repositories: true).
+#
+# Merge stays reserved for Ben: branch protection on terraform-git's main sets a
+# merge whitelist of the Owners team only. Keep this team out of every merge and
+# approval whitelist.
+description: "repospawner bot -- push branches + open PRs on terraform-git only"
+permission: write
+include_all_repositories: false
+can_create_repos: false
+repositories:
+  - terraform-git
+members:
+  - repospawner

config/git.unkin.net/user/repospawner.yaml

@@ -0,0 +1,22 @@
+# Service identity for repospawner, which opens pull requests against this
+# repository (terraform-git) to add new Gitea repositories on request. It is
+# deliberately separate from unkin-agent so its access can stay scoped to the
+# single repository it needs: the "repospawner" team (unkin/team/repospawner.yaml)
+# grants Write on terraform-git and nothing else.
+#
+# Auth is via ephemeral API tokens minted by the vault-plugin-secrets-gitea
+# engine -- no usable credential lives in this repo's state beyond the generated
+# placeholder. Merge stays blocked by branch protection (merge whitelist =
+# Owners only), so it can push branches and open PRs but never merge.
+email: repospawner@unkin.net
+full_name: "Repo Spawner"
+description: "repospawner service identity -- opens repo-creation PRs against terraform-git"
+# Conservative bot posture: not a site admin, cannot create orgs or repos,
+# profile visible only to signed-in users.
+visibility: limited
+admin: false
+# Restricted: account can only see repos/orgs it is explicitly added to -- the
+# repospawner team grant on terraform-git is all it needs.
+restricted: true
+allow_create_organization: false
+max_repo_creation: 0

config/git.unkin.net/user/unkin-agent.yaml

@@ -0,0 +1,18 @@
+# Shared identity used by Ben's AI coding agents to submit work (branches, pull
+# requests, issues, comments) as a distinct, attributable, least-privilege
+# account instead of Ben's own login. Auth is via ephemeral API tokens minted by
+# the vault-plugin-secrets-gitea engine (gitea/creds/unkin-agent) -- no token or
+# usable password lives in this repo's state beyond the generated placeholder.
+#
+# Write access comes from the "agents" team (team/agents.yaml); merge is blocked
+# by branch protection (merge whitelist = Owners only), so the agent can open and
+# comment on PRs/issues but never merge or approve.
+email: unkin-agent@unkin.net
+full_name: "Unkin Agent"
+description: "shared identity for automated AI coding agents -- write, never merge"
+# Conservative bot posture: not a site admin, cannot create orgs or repos,
+# profile visible only to signed-in users.
+visibility: limited
+admin: false
+allow_create_organization: false
+max_repo_creation: 0

modules/gitea_instance/imports.tf

@@ -4,167 +4,167 @@ import {
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/puppet-prod"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/puppet-prod"].gitea_repository.this[0]
   id = "2"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/puppet-r10k"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/puppet-r10k"].gitea_repository.this[0]
   id = "3"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/rpmbuild-gonic"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/rpmbuild-gonic"].gitea_repository.this[0]
   id = "23"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/docker-almalinux-base"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/docker-almalinux-base"].gitea_repository.this[0]
   id = "24"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/rpmbuild-internal-ca-certificates"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/rpmbuild-internal-ca-certificates"].gitea_repository.this[0]
   id = "27"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/rpmbuild-template"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/rpmbuild-template"].gitea_repository.this[0]
   id = "29"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/rpmbuild-jellyfin-web"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/rpmbuild-jellyfin-web"].gitea_repository.this[0]
   id = "31"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/rpmbuild-proxlb"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/rpmbuild-proxlb"].gitea_repository.this[0]
   id = "33"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/docker-almalinux-buildrunner"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/docker-almalinux-buildrunner"].gitea_repository.this[0]
   id = "36"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/docker-template"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/docker-template"].gitea_repository.this[0]
   id = "38"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/terraform-vault"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/terraform-vault"].gitea_repository.this[0]
   id = "39"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/docker-almalinux-jupyterinstance"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/docker-almalinux-jupyterinstance"].gitea_repository.this[0]
   id = "40"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/rpmbuilder"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/rpmbuilder"].gitea_repository.this[0]
   id = "41"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/docker-almalinux-runnerdnd"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/docker-almalinux-runnerdnd"].gitea_repository.this[0]
   id = "43"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/initbuilder"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/initbuilder"].gitea_repository.this[0]
   id = "47"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/puppetapi"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/puppetapi"].gitea_repository.this[0]
   id = "50"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/terraform-nomad"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/terraform-nomad"].gitea_repository.this[0]
   id = "53"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/packer-images"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/packer-images"].gitea_repository.this[0]
   id = "59"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/app-sudaporn-research-normalised"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/app-sudaporn-research-normalised"].gitea_repository.this[0]
   id = "60"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/app-sudaporn-research-individual"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/app-sudaporn-research-individual"].gitea_repository.this[0]
   id = "63"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/terraform-incus"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/terraform-incus"].gitea_repository.this[0]
   id = "66"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/artifactapi"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/artifactapi"].gitea_repository.this[0]
   id = "67"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/argocd-apps"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/argocd-apps"].gitea_repository.this[0]
   id = "100"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/certmanager"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/certmanager"].gitea_repository.this[0]
   id = "101"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/node-lookup"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/node-lookup"].gitea_repository.this[0]
   id = "102"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/container-devcompute"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/container-devcompute"].gitea_repository.this[0]
   id = "135"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/streamstack"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/streamstack"].gitea_repository.this[0]
   id = "136"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/terraform-provider-artifactapi"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/terraform-provider-artifactapi"].gitea_repository.this[0]
   id = "137"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/forgebot"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/forgebot"].gitea_repository.this[0]
   id = "139"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/forgebot-skills"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/forgebot-skills"].gitea_repository.this[0]
   id = "140"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/container-agent-base"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/container-agent-base"].gitea_repository.this[0]
   id = "141"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/container-agent-dev"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/container-agent-dev"].gitea_repository.this[0]
   id = "142"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/container-agent-infra"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/container-agent-infra"].gitea_repository.this[0]
   id = "143"
 }
 
@@ -199,7 +199,54 @@ import {
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/terraform-git"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/terraform-git"].gitea_repository.this[0]
   id = "144"
 }
 
+# Branch protections that already exist in Gitea but are not yet in state.
+# Import id format is <organisation>/<repository>/<rule_name>.
+import {
+  to = module.branch_protection["git.unkin.net/unkin/app-sudaporn-research-individual/master"].gitea_repository_branch_protection.this
+  id = "unkin/app-sudaporn-research-individual/master"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/app-sudaporn-research-normalised/master"].gitea_repository_branch_protection.this
+  id = "unkin/app-sudaporn-research-normalised/master"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/benvin-utils/main"].gitea_repository_branch_protection.this
+  id = "unkin/benvin-utils/main"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/container-devcompute/main"].gitea_repository_branch_protection.this
+  id = "unkin/container-devcompute/main"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/docker-template/master"].gitea_repository_branch_protection.this
+  id = "unkin/docker-template/master"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/initbuilder/main"].gitea_repository_branch_protection.this
+  id = "unkin/initbuilder/main"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/puppetapi/master"].gitea_repository_branch_protection.this
+  id = "unkin/puppetapi/master"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/rpmbuild-internal-ca-certificates/master"].gitea_repository_branch_protection.this
+  id = "unkin/rpmbuild-internal-ca-certificates/master"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/streamstack/main"].gitea_repository_branch_protection.this
+  id = "unkin/streamstack/main"
+}
+

modules/gitea_instance/main.tf

@@ -19,6 +19,7 @@ module "repository" {
 
   name                    = each.value.name
   organisation            = each.value.organisation
+  fork_from               = each.value.fork_from
   description             = each.value.description
   private                 = each.value.private
   default_branch          = each.value.default_branch
@@ -35,6 +36,16 @@ module "repository" {
   website                 = each.value.website
   autodetect_manual_merge = each.value.autodetect_manual_merge
 
+  mirror                    = each.value.mirror
+  migration_clone_address   = each.value.migration_clone_address
+  migration_service         = each.value.migration_service
+  migration_mirror_interval = each.value.migration_mirror_interval
+  migration_lfs             = each.value.migration_lfs
+  migration_lfs_endpoint    = each.value.migration_lfs_endpoint
+  migration_issue_labels    = each.value.migration_issue_labels
+  migration_milestones      = each.value.migration_milestones
+  migration_releases        = each.value.migration_releases
+
   depends_on = [module.organisation]
 }
 

modules/gitea_instance/modules/branch_protection/terraform.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     gitea = {
       source  = "go-gitea/gitea"
-      version = "0.7.0"
+      version = "0.8.1"
     }
   }
 }

modules/gitea_instance/modules/deploy_key/terraform.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     gitea = {
       source  = "go-gitea/gitea"
-      version = "0.7.0"
+      version = "0.8.1"
     }
   }
 }

modules/gitea_instance/modules/organisation/terraform.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     gitea = {
       source  = "go-gitea/gitea"
-      version = "0.7.0"
+      version = "0.8.1"
     }
   }
 }

modules/gitea_instance/modules/repository/main.tf

@@ -1,4 +1,10 @@
+locals {
+  fork_source = var.fork_from == null ? null : split("/", var.fork_from)
+}
+
 resource "gitea_repository" "this" {
+  count = var.fork_from == null ? 1 : 0
+
   username                = var.organisation
   name                    = var.name
   description             = var.description
@@ -17,4 +23,33 @@ resource "gitea_repository" "this" {
   website                 = var.website
   autodetect_manual_merge = var.autodetect_manual_merge
   archive_on_destroy      = true
+
+  mirror                    = var.mirror
+  migration_clone_address   = var.migration_clone_address
+  migration_service         = var.migration_service
+  migration_mirror_interval = var.migration_mirror_interval
+  migration_lfs             = var.migration_lfs
+  migration_lfs_endpoint    = var.migration_lfs_endpoint
+  migration_issue_labels    = var.migration_issue_labels
+  migration_milestones      = var.migration_milestones
+  migration_releases        = var.migration_releases
+
+  lifecycle {
+    # migration_mirror_interval defaults to "8h0m0s" but Gitea returns an empty MirrorInterval for non-mirror repos, so the read-back never matches and plans a spurious update every run; it is a migration-only knob with no drift to track here.
+    ignore_changes = [migration_mirror_interval]
+  }
+}
+
+moved {
+  from = gitea_repository.this
+  to   = gitea_repository.this[0]
+}
+
+# gitea_fork has no archive_on_destroy, so removing a fork from the config deletes the repository instead of archiving it.
+resource "gitea_fork" "this" {
+  count = var.fork_from == null ? 0 : 1
+
+  owner        = local.fork_source[0]
+  repo         = local.fork_source[1]
+  organization = var.organisation
 }

modules/gitea_instance/modules/repository/outputs.tf

@@ -1,3 +1,3 @@
 output "id" {
-  value = gitea_repository.this.id
+  value = one(concat(gitea_repository.this[*].id, gitea_fork.this[*].id))
 }

modules/gitea_instance/modules/repository/terraform.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     gitea = {
       source  = "go-gitea/gitea"
-      version = "0.7.0"
+      version = "0.8.1"
     }
   }
 }

modules/gitea_instance/modules/repository/variables.tf

@@ -6,6 +6,22 @@ variable "organisation" {
   type = string
 }
 
+variable "fork_from" {
+  description = "Source repository to fork, as \"<owner>/<repo>\". When set, a fork is created instead of a new repository."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = var.fork_from == null || can(regex("^[^/]+/[^/]+$", var.fork_from))
+    error_message = "fork_from must be \"<owner>/<repo>\"."
+  }
+
+  validation {
+    condition     = var.fork_from == null || try(split("/", var.fork_from)[1], null) == var.name
+    error_message = "fork_from source repository must be named \"${var.name}\": a fork inherits the source name, so it cannot differ from the config file name."
+  }
+}
+
 variable "description" {
   type    = string
   default = null
@@ -80,3 +96,48 @@ variable "autodetect_manual_merge" {
   type    = bool
   default = null
 }
+
+variable "mirror" {
+  type    = bool
+  default = null
+}
+
+variable "migration_clone_address" {
+  type    = string
+  default = null
+}
+
+variable "migration_service" {
+  type    = string
+  default = null
+}
+
+variable "migration_mirror_interval" {
+  type    = string
+  default = null
+}
+
+variable "migration_lfs" {
+  type    = bool
+  default = null
+}
+
+variable "migration_lfs_endpoint" {
+  type    = string
+  default = null
+}
+
+variable "migration_issue_labels" {
+  type    = bool
+  default = null
+}
+
+variable "migration_milestones" {
+  type    = bool
+  default = null
+}
+
+variable "migration_releases" {
+  type    = bool
+  default = null
+}

modules/gitea_instance/modules/team/main.tf

@@ -8,7 +8,8 @@ resource "gitea_team" "this" {
   repositories             = var.repositories
 
   lifecycle {
-    ignore_changes = [permission]
+    # Gitea's SDK rejects the stored permission=none on any EditTeam call; units/repositories only churn on provider representation (unordered units string, sorted/include-all repos), so ignore them to avoid spurious edits that would fail.
+    ignore_changes = [permission, units, repositories]
   }
 }
 

modules/gitea_instance/modules/team/terraform.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     gitea = {
       source  = "go-gitea/gitea"
-      version = "0.7.0"
+      version = "0.8.1"
     }
   }
 }