Add a pull mirror of github.com/9p4/jellyfin-plugin-sso into the mirrors
organisation, syncing every 8h with issues, pull requests and release
migration disabled.
gitea_fork can only express the source repo and owning organisation, so any
other setting in a fork's yaml is silently dropped.
- validate fork_from entries carry no other repository attributes, naming the
offending config key and attributes
- note that gitea_fork has no archive_on_destroy
Express a fork as an optional fork_from key on the repository yaml, so a
forked repo is declared the same way as any other repo.
- add fork_from "<owner>/<repo>" to the repository module and object type
- create gitea_fork instead of gitea_repository when fork_from is set
- validate the source repo name matches the config file name, since a fork
inherits the source name
- move gitea_repository.this to index 0 for the count refactor
- index existing repository import targets to match
Host the Go rewrites of the certmanager and sshsignhost Vault signing
helpers.
- Add config/git.unkin.net/unkin/repository/puppet-vault-signers.yaml
- Protect main with Owners-only merge and the standard woodpecker checks
Defense in depth for the repo-creation bot: a restricted Gitea account can
only see repositories and organisations it is explicitly added to, so a
leaked repospawner token cannot enumerate or read the rest of the estate.
The repospawner team grant on terraform-git already covers everything the
bot does, so nothing it needs is lost.
repospawner opens repo-creation PRs against terraform-git and needs no other
access, so give it its own identity and a per-repo team instead of adding it to
the org-wide agents team.
- add config/git.unkin.net/user/repospawner.yaml (limited visibility, not admin,
no org/repo creation), mirroring the unkin-agent bot posture
- add config/git.unkin.net/unkin/team/repospawner.yaml granting write on the
terraform-git repository only (include_all_repositories false)
The terraform-nomad project is being decommissioned; mark it archived
in Gitea so it becomes read-only, consistent with other retired repos
in this config (e.g. rpmbuild-template).
PR plan pipelines were failing with "Error acquiring the state lock"
when they collided with a concurrent apply (or another plan) holding
the lock on the same Consul-backed state.
- plan: pass -lock=false to terragrunt plan; apply/apply-if-changes keep locking
Both repos do not need to be private, and their main branches should
only accept PRs whose Woodpecker pipeline passed.
- private: false for clickhouse-tools and logviewer
- require ci/woodpecker/pr/build status check on main for both
The waitfordb CI is being split into three Woodpecker PR workflows
(pre-commit, test, build), each exposing its own status context. Require
all three on the main branch protection so a PR cannot merge until
pre-commit, test, and build all pass. Mirrors node-lookup.
Owners-only merge, benvin approval, and the required Woodpecker PR check.
Requires the repo to be activated in Woodpecker so ci/woodpecker/pr/build
reports before a PR can merge.
waitfordb is a small Go tool shipped as a container image, used as a Kubernetes
initContainer to block an app from starting until its database is ready. It
replaces the hand-written psql-in-a-shell init steps on the arrstack.
Creates the unkin/waitfordb Gitea repo (Go tool settings mirroring node-lookup:
public, squash merges, delete branch after merge). branch_protection is omitted
on creation to avoid requiring Woodpecker status checks that do not exist until
the first pipeline runs; it will be added in a follow-up PR once CI is green.
terraform-provider-arrstackvaultsecret is a bespoke Terraform provider that
configures the new arrstack Vault/OpenBao secrets engine (engine config +
roles) from terraform-vault, following the per-engine-provider convention
used by the gpg/litellm/rancher vault-secret providers. It needs a Gitea
repo to host its source before CI and releases can be wired up.
- add config/git.unkin.net/unkin/repository/terraform-provider-arrstackvaultsecret.yaml
- public repo, default branch main, delete-branch-after-merge, squash-only
- Owners-only merge with required pre-commit/build/test Woodpecker checks
vault-plugin-secrets-arrstack is a new Vault/OpenBao secrets engine that
dynamically mints arrproxy machine (per-user) API tokens, enabling
terraform-driven onboarding of *arr services. It needs a Gitea repo to
host its source before CI and releases can be wired up.
- add config/git.unkin.net/unkin/repository/vault-plugin-secrets-arrstack.yaml
- public repo, default branch main, delete-branch-after-merge, squash-only
- Owners-only merge with required pre-commit/build/test Woodpecker checks
2026-08-18 20:47:41 +10:00
28 changed files with 441 additions and 37 deletions
description:"Build repo that compiles the tailscale/go-cache-plugin GOCACHEPROG S3 Go build cache from a pinned upstream module version and publishes static binaries as Gitea releases."
description:"Media copy/move tool: Go API + UI spawning per-file k8s Jobs from mediafs CephFS to media PVCs; doubles as a Ceph aggregate-bandwidth test"
description:"A small Go tool, shipped as a container image, used as a Kubernetes initContainer to block an app from starting until its database is ready."
# migration_mirror_interval defaults to "8h0m0s" but Gitea returns an empty MirrorInterval for non-mirror repos, so the read-back never matches and plans a spurious update every run; it is a migration-only knob with no drift to track here.
ignore_changes=[migration_mirror_interval]
}
}
moved{
from=gitea_repository.this
to=gitea_repository.this[0]
}
# gitea_fork has no archive_on_destroy, so removing a fork from the config deletes the repository instead of archiving it.
error_message="fork_from source repository must be named \"${var.name}\": a fork inherits the source name, so it cannot differ from the config file name."
error_message="gitea_fork only takes the source repository and the owning organisation, so fork_from cannot be combined with other repository settings: ${join("; ",[
forkey,repoinvar.repository:
"${key} also sets ${join(", ",[forattribute, valueinrepo:attributeif value!=null&&!contains(["name","organisation","fork_from"],attribute)])}"
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
benvin
unkin-agent
unkin-agent