Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 benvin
|
5c784eff19 | ||
 unkinben
|
cee451f741 |
@@ -7,10 +7,9 @@ steps:
|
|||||||
image: git.unkin.net/unkin/almalinux9-opentofu:20260606
|
image: git.unkin.net/unkin/almalinux9-opentofu:20260606
|
||||||
environment:
|
environment:
|
||||||
VAULT_AUTH_METHOD: kubernetes
|
VAULT_AUTH_METHOD: kubernetes
|
||||||
VAULT_VERSION: "1.20.0"
|
|
||||||
commands:
|
commands:
|
||||||
- curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
|
- dnf install vault -y
|
||||||
- make apply
|
- make apply-if-changes
|
||||||
backend_options:
|
backend_options:
|
||||||
kubernetes:
|
kubernetes:
|
||||||
serviceAccountName: terraform-git
|
serviceAccountName: terraform-git
|
||||||
|
|||||||
@@ -6,9 +6,8 @@ steps:
|
|||||||
image: git.unkin.net/unkin/almalinux9-opentofu:20260606
|
image: git.unkin.net/unkin/almalinux9-opentofu:20260606
|
||||||
environment:
|
environment:
|
||||||
VAULT_AUTH_METHOD: kubernetes
|
VAULT_AUTH_METHOD: kubernetes
|
||||||
VAULT_VERSION: "1.20.0"
|
|
||||||
commands:
|
commands:
|
||||||
- curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
|
- dnf install vault -y
|
||||||
- make plan
|
- make plan
|
||||||
backend_options:
|
backend_options:
|
||||||
kubernetes:
|
kubernetes:
|
||||||
|
|||||||
@@ -33,14 +33,6 @@ locals {
|
|||||||
})
|
})
|
||||||
if length(regexall("/team/", file_path)) > 0
|
if length(regexall("/team/", file_path)) > 0
|
||||||
}
|
}
|
||||||
user = {
|
|
||||||
for file_path, content in local.all_configs :
|
|
||||||
"${split("/", file_path)[0]}/${trimsuffix(basename(file_path), ".yaml")}" => merge(content, {
|
|
||||||
username = trimsuffix(basename(file_path), ".yaml")
|
|
||||||
gitea_url = split("/", file_path)[0]
|
|
||||||
})
|
|
||||||
if length(regexall("/user/", file_path)) > 0
|
|
||||||
}
|
|
||||||
branch_protection = merge([
|
branch_protection = merge([
|
||||||
for file_path, content in local.all_configs : {
|
for file_path, content in local.all_configs : {
|
||||||
for idx, rule in try(content.branch_protection, []) :
|
for idx, rule in try(content.branch_protection, []) :
|
||||||
|
|||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Simple API for showing a users age"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "CLI tools for orchestrator PR automation as unkin-agent"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,9 +1,4 @@
|
|||||||
description: "Sudaporn's Research Data visualisation, normalised "
|
description: "Sudaporn's Research Data visualisation, normalised "
|
||||||
private: false
|
private: false
|
||||||
default_branch: "master"
|
default_branch: "master"
|
||||||
default_delete_branch_after_merge: true
|
default_delete_branch_after_merge: false
|
||||||
branch_protection:
|
|
||||||
- rule_name: "master"
|
|
||||||
enable_push: false
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
|
|||||||
@@ -1,9 +1,4 @@
|
|||||||
description: "Sudaporn's Research Data visualisation, normalised"
|
description: "Sudaporn's Research Data visualisation, normalised"
|
||||||
private: false
|
private: false
|
||||||
default_branch: "master"
|
default_branch: "master"
|
||||||
default_delete_branch_after_merge: true
|
default_delete_branch_after_merge: false
|
||||||
branch_protection:
|
|
||||||
- rule_name: "master"
|
|
||||||
enable_push: false
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
|
|||||||
@@ -4,12 +4,10 @@ default_delete_branch_after_merge: true
|
|||||||
default_merge_style: "squash"
|
default_merge_style: "squash"
|
||||||
branch_protection:
|
branch_protection:
|
||||||
- rule_name: "main"
|
- rule_name: "main"
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
enable_push: false
|
||||||
status_check_contexts:
|
status_check_contexts:
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
- "ci/woodpecker/pr/pre-commit"
|
||||||
- "ci/woodpecker/pr/kubeconform"
|
- "ci/woodpecker/pr/kubeconform"
|
||||||
- "ci/woodpecker/pr/vector-test"
|
|
||||||
approval_whitelist_users:
|
approval_whitelist_users:
|
||||||
- "benvin"
|
- "unkinben"
|
||||||
|
woodpecker: true
|
||||||
|
|||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "arrstack reverse proxy: oauth2-gated UI + per-user API-key broker"
|
|
||||||
private: true
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -5,12 +5,11 @@ default_delete_branch_after_merge: true
|
|||||||
default_merge_style: "squash"
|
default_merge_style: "squash"
|
||||||
branch_protection:
|
branch_protection:
|
||||||
- rule_name: "master"
|
- rule_name: "master"
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
enable_push: false
|
||||||
status_check_contexts:
|
status_check_contexts:
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
- "ci/woodpecker/pr/pre-commit"
|
||||||
- "ci/woodpecker/pr/test"
|
- "ci/woodpecker/pr/test"
|
||||||
- "ci/woodpecker/pr/build"
|
- "ci/woodpecker/pr/build"
|
||||||
approval_whitelist_users:
|
approval_whitelist_users:
|
||||||
- "benvin"
|
- "unkinben"
|
||||||
|
woodpecker: true
|
||||||
|
|||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Kubernetes operator that provisions S3 buckets and backup schedules from backups.unkin.net/* annotations on PVCs and CNPG clusters"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
description: "Monorepo of small single-purpose CLI tools sharing a common library"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Kubernetes operator for managing BIND9 DNS clusters, zones, views, and TSIG keys"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
description: "Builds AlmaLinux node rootfs tarballs for bootapi image-based provisioning; on v* tag publishes almalinux9-node-<ver>.tar.zst to the artifactapi rootfs-images repo."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/lint"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
description: "Live kickstart/iPXE templates + distro catalog for bootapi. Pulled by bootapi via git-sync; CI validates templates render for every distro."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/validate"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "PXE/kickstart boot service replacing Cobbler. Renders kickstart + iPXE from NetBox data over HTTP. Go API."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Kubernetes operator that provisions Ceph RGW (S3) buckets and access keys (RW/RO) from CRDs via the Ceph manager dashboard API"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,11 +1,12 @@
|
|||||||
description: "Vault PKI certificate issuance and SSH host key signing tool for Puppet-managed infrastructure"
|
description: "Vault PKI certificate issuance and SSH host key signing tool for Puppet-managed infrastructure"
|
||||||
private: false
|
private: false
|
||||||
default_branch: "master"
|
default_branch: "master"
|
||||||
default_delete_branch_after_merge: true
|
default_delete_branch_after_merge: false
|
||||||
branch_protection:
|
branch_protection:
|
||||||
- rule_name: "master"
|
- rule_name: "master"
|
||||||
enable_push: false
|
enable_push: false
|
||||||
merge_whitelist_users:
|
merge_whitelist_users:
|
||||||
- "benvin"
|
- "unkinben"
|
||||||
approval_whitelist_users:
|
approval_whitelist_users:
|
||||||
- "benvin"
|
- "unkinben"
|
||||||
|
woodpecker: true
|
||||||
|
|||||||
@@ -1,15 +0,0 @@
|
|||||||
description: "Base container image for forgebot agents"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "docker"
|
|
||||||
- "forgebot"
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
description: "Dev toolchain container for forgebot agents"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "docker"
|
|
||||||
- "forgebot"
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
description: "Infrastructure toolchain container for forgebot agents"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "docker"
|
|
||||||
- "forgebot"
|
|
||||||
@@ -1,8 +1,3 @@
|
|||||||
description: "Docker image to be used in Kubernetes as a developers container"
|
description: "Docker image to be used in Kubernetes as a developers container"
|
||||||
private: false
|
private: false
|
||||||
default_delete_branch_after_merge: true
|
default_delete_branch_after_merge: false
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
|
|||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "RFC2136 dynamic-DNS updater daemon: watches a records file and network interfaces and pushes TSIG-signed updates to BIND, with a local status API for facter."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -3,8 +3,3 @@ private: false
|
|||||||
default_branch: "master"
|
default_branch: "master"
|
||||||
default_delete_branch_after_merge: true
|
default_delete_branch_after_merge: true
|
||||||
repo_template: true
|
repo_template: true
|
||||||
branch_protection:
|
|
||||||
- rule_name: "master"
|
|
||||||
enable_push: false
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
|
|||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Postgres-backed External Node Classifier (ENC) for Puppet, replacing Cobbler. Go API + encapi-cli."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Dependency-less Go CLI client for encapi, used as the Puppet exec External Node Classifier (ENC) on k8s compilers. Fetches the cobbler-wire ENC document and reshapes it for the puppet exec node_terminus."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
description: "Skill definitions for forgebot agents"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/validate"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "forgebot"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "forgebot"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "K8s operator + API for AI agent dispatch from git forges"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "forgebot"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "forgebot"
|
|
||||||
@@ -1,17 +0,0 @@
|
|||||||
description: "Fork of goodtune/ghp (GitHub proxy) with unkin patches"
|
|
||||||
private: true
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
# Whitelist-push: the owner can push main directly (needed for the initial
|
|
||||||
# push and the fork's maintenance workflow); everyone else must open a PR.
|
|
||||||
enable_push: true
|
|
||||||
push_whitelist_users:
|
|
||||||
- "unkinben"
|
|
||||||
# PRs to main must pass the fork build/vet pipeline before merge.
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
@@ -1,8 +1,3 @@
|
|||||||
description: "A repository for building initrd.img in docker "
|
description: "A repository for building initrd.img in docker "
|
||||||
private: false
|
private: false
|
||||||
default_delete_branch_after_merge: true
|
default_delete_branch_after_merge: false
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
|
|||||||
@@ -1,11 +0,0 @@
|
|||||||
description: "Source fork of ZoltyMat/jellyfin-ha carrying HA patches"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/ci"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
description: "Container build for the jellyfin-ha (HA transcoding) Jellyfin fork"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "docker"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Kubernetes operator for managing Kea DHCP clusters, subnets, and PXE client classes"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Archives raw logs from NATS JetStream to S3 as zstd-compressed, GPG-encrypted, indexed objects; plus a CLI to search and retrieve them. Go service + CLI."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,16 +1,15 @@
|
|||||||
description: "A CLI tool written in Go that queries the PuppetDB API to look up and filter node facts."
|
description: "A CLI tool written in Go that queries the PuppetDB API to look up and filter node facts."
|
||||||
private: false
|
private: false
|
||||||
default_branch: "main"
|
default_branch: "master"
|
||||||
default_delete_branch_after_merge: true
|
default_delete_branch_after_merge: true
|
||||||
default_merge_style: "squash"
|
default_merge_style: "squash"
|
||||||
branch_protection:
|
branch_protection:
|
||||||
- rule_name: "main"
|
- rule_name: "master"
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
enable_push: false
|
||||||
status_check_contexts:
|
status_check_contexts:
|
||||||
- "ci/woodpecker/pr/build"
|
- "ci/woodpecker/pr/lint"
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
- "ci/woodpecker/pr/pre-commit"
|
||||||
|
- "ci/woodpecker/pr/unit-tests"
|
||||||
approval_whitelist_users:
|
approval_whitelist_users:
|
||||||
- "benvin"
|
- "unkinben"
|
||||||
|
woodpecker: true
|
||||||
|
|||||||
@@ -1,17 +0,0 @@
|
|||||||
description: "Private fork of OpenBao adding per-namespace raft, cross-cluster performance replicas, virtual KV, and KV events"
|
|
||||||
private: true
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
# Whitelist-push: the owner can push main directly (needed for the initial
|
|
||||||
# push and the fork's maintenance workflow); everyone else must open a PR.
|
|
||||||
enable_push: true
|
|
||||||
push_whitelist_users:
|
|
||||||
- "unkinben"
|
|
||||||
# PRs to main must pass the fork build/vet pipeline before merge.
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "Vault-backed drop-in replacement for pass (password-store); routes GPG crypto through vault-plugin-secrets-gpg"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Merging HTTP proxy over two PuppetDB backends, presenting a single merged PuppetDB v4 query surface during the VM to k8s Puppet migration. Deployed in-cluster via argocd-apps."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
description: "Woodpecker plugin-docker-buildx image with the internal Vault-PKI CA baked in (trusts artifactapi)"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "docker"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Private fork of Prowlarr: Postgres backend + stateless multi-replica for the arrstack"
|
|
||||||
private: true
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
# Owner can push main directly for fork maintenance (upstream-fix merges);
|
|
||||||
# everyone else opens a PR that must pass the Woodpecker image build.
|
|
||||||
enable_push: true
|
|
||||||
push_whitelist_users:
|
|
||||||
- "unkinben"
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/docker"
|
|
||||||
@@ -35,3 +35,4 @@ branch_protection:
|
|||||||
- "ci/woodpecker/pr/yamllint"
|
- "ci/woodpecker/pr/yamllint"
|
||||||
approval_whitelist_teams:
|
approval_whitelist_teams:
|
||||||
- "puppet"
|
- "puppet"
|
||||||
|
woodpecker: true
|
||||||
|
|||||||
@@ -13,3 +13,4 @@ branch_protection:
|
|||||||
approval_whitelist_teams:
|
approval_whitelist_teams:
|
||||||
- "puppet"
|
- "puppet"
|
||||||
block_on_rejected_reviews: true
|
block_on_rejected_reviews: true
|
||||||
|
woodpecker: true
|
||||||
|
|||||||
@@ -2,8 +2,3 @@ description: "A fastapi service to present puppet services via an api"
|
|||||||
private: false
|
private: false
|
||||||
default_branch: "master"
|
default_branch: "master"
|
||||||
default_delete_branch_after_merge: true
|
default_delete_branch_after_merge: true
|
||||||
branch_protection:
|
|
||||||
- rule_name: "master"
|
|
||||||
enable_push: false
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
|
|||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Private fork of Radarr: Postgres backend + stateless multi-replica for the arrstack"
|
|
||||||
private: true
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
# Owner can push main directly for fork maintenance (upstream-fix merges);
|
|
||||||
# everyone else opens a PR that must pass the Woodpecker image build.
|
|
||||||
enable_push: true
|
|
||||||
push_whitelist_users:
|
|
||||||
- "unkinben"
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/docker"
|
|
||||||
@@ -1,9 +1,4 @@
|
|||||||
description: "Package the internal ca-certificates"
|
description: "Package the internal ca-certificates"
|
||||||
private: false
|
private: false
|
||||||
default_branch: "master"
|
default_branch: "master"
|
||||||
default_delete_branch_after_merge: true
|
default_delete_branch_after_merge: false
|
||||||
branch_protection:
|
|
||||||
- rule_name: "master"
|
|
||||||
enable_push: false
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
|
|||||||
@@ -1,5 +1,5 @@
|
|||||||
description: "Build rpms for jellyfin-web"
|
description: "Build rpms for jellyfin-web"
|
||||||
private: false
|
private: false
|
||||||
default_branch: "master"
|
default_branch: "master"
|
||||||
default_delete_branch_after_merge: true
|
default_delete_branch_after_merge: false
|
||||||
archived: true
|
archived: true
|
||||||
|
|||||||
@@ -18,3 +18,4 @@ branch_protection:
|
|||||||
approval_whitelist_teams:
|
approval_whitelist_teams:
|
||||||
- "rpmbuild"
|
- "rpmbuild"
|
||||||
block_on_rejected_reviews: true
|
block_on_rejected_reviews: true
|
||||||
|
woodpecker: true
|
||||||
|
|||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Private fork of Sonarr: Postgres backend + stateless multi-replica for the arrstack"
|
|
||||||
private: true
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
# Owner can push main directly for fork maintenance (upstream-fix merges);
|
|
||||||
# everyone else opens a PR that must pass the Woodpecker image build.
|
|
||||||
enable_push: true
|
|
||||||
push_whitelist_users:
|
|
||||||
- "unkinben"
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/docker"
|
|
||||||
@@ -1,8 +1,3 @@
|
|||||||
description: "A stack of microservices that aim to offer a distributed streaming service."
|
description: "A stack of microservices that aim to offer a distributed streaming service."
|
||||||
private: false
|
private: false
|
||||||
default_delete_branch_after_merge: true
|
default_delete_branch_after_merge: false
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
|
|||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "A Go daemon that watches Gitea repos and dispatches one-shot Claude Code sessions in Docker to work issues and review PRs."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
description: "Terraform configuration for managing ArtifactAPI remote and virtual repositories"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
merge_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
- "unkinben"
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/plan"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
description: "Terraform configuration for managing Authentik identity provider"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
merge_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
- "unkinben"
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/plan"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,16 +1,14 @@
|
|||||||
description: "Manage Gitea resources, teams, repos, and Woodpecker CI via Terraform"
|
description: "Manage Gitea resources, teams, repos, and Woodpecker CI via Terraform"
|
||||||
private: false
|
private: false
|
||||||
default_branch: "main"
|
default_branch: "main"
|
||||||
default_delete_branch_after_merge: true
|
woodpecker: true
|
||||||
branch_protection:
|
branch_protection:
|
||||||
- rule_name: "main"
|
- rule_name: "main"
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
enable_push: false
|
||||||
status_check_contexts:
|
status_check_contexts:
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
- "ci/woodpecker/pr/pre-commit"
|
||||||
- "ci/woodpecker/pr/plan"
|
- "ci/woodpecker/pr/plan"
|
||||||
approval_whitelist_users:
|
approval_whitelist_users:
|
||||||
- "benvin"
|
- "unkinben"
|
||||||
approval_whitelist_teams:
|
approval_whitelist_teams:
|
||||||
- "Owners"
|
- "Owners"
|
||||||
|
|||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "YAML-driven Terraform for NetBox IPAM, networks, and devices + Kea DHCP"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/plan"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,7 +1,7 @@
|
|||||||
description: "Manage nomad with Terraform"
|
description: "Manage nomad with Terraform"
|
||||||
private: false
|
private: false
|
||||||
default_branch: "master"
|
default_branch: "master"
|
||||||
default_delete_branch_after_merge: true
|
default_delete_branch_after_merge: false
|
||||||
branch_protection:
|
branch_protection:
|
||||||
- rule_name: "master"
|
- rule_name: "master"
|
||||||
enable_push: false
|
enable_push: false
|
||||||
|
|||||||
@@ -1,14 +1,9 @@
|
|||||||
description: "Terraform provider for managing ArtifactAPI"
|
description: "Terraform provider for managing ArtifactAPI"
|
||||||
private: false
|
private: false
|
||||||
default_delete_branch_after_merge: true
|
default_delete_branch_after_merge: false
|
||||||
branch_protection:
|
branch_protection:
|
||||||
- rule_name: "main"
|
- rule_name: "main"
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
enable_push: false
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
approval_whitelist_teams:
|
||||||
- "Owners"
|
- "Owners"
|
||||||
|
woodpecker: true
|
||||||
|
|||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Terraform provider for encapi: manage Puppet ENC roles, statuses, and node assignments."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "Terraform provider for the Vault/OpenBao Gitea token secrets engine (giteavaultsecret)"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "Terraform provider for the Vault/OpenBao GPG/OpenPGP secrets engine (gpgvaultsecret) — manage backends and keys"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Terraform provider for the kea-operator KeaAPI: manage Kea DHCP subnets and PXE client classes."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "Terraform provider for the Vault/OpenBao LiteLLM dynamic secrets engine (litellmvaultsecret)"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "Terraform provider for the Vault/OpenBao Rancher token secrets engine (ranchervaultsecret)"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Terraform provider for tomswallapi: manage fleet-global firewall policy (zones, address groups, portgroups, rules, policies, fabrics) and per-device bindings."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "Terraform provider for the Vault/OpenBao ghp token secrets engine (vault-secrets-ghp)"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "Terraform provider for the Vault/OpenBao NetBox token secrets engine (pairs with vault-plugin-secrets-netbox)"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
description: "Terraform configuration for managing Prowlarr indexer automation"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
merge_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
- "unkinben"
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/plan"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
description: "Terraform configuration for managing Radarr movie automation"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
merge_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
- "unkinben"
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/plan"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
description: "Terraform configuration for managing Rancher (auth, roles) via the rancher2 provider"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
merge_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
- "unkinben"
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/plan"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
description: "Terraform configuration for managing Sonarr TV automation"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
enable_push: false
|
|
||||||
merge_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
- "unkinben"
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/plan"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -13,6 +13,7 @@ branch_protection:
|
|||||||
- "ci/woodpecker/pr/pre-commit"
|
- "ci/woodpecker/pr/pre-commit"
|
||||||
- "ci/woodpecker/pr/plan"
|
- "ci/woodpecker/pr/plan"
|
||||||
approval_whitelist_users:
|
approval_whitelist_users:
|
||||||
- "benvin"
|
- "unkinben"
|
||||||
approval_whitelist_teams:
|
approval_whitelist_teams:
|
||||||
- "Owners"
|
- "Owners"
|
||||||
|
woodpecker: true
|
||||||
|
|||||||
@@ -1,15 +0,0 @@
|
|||||||
description: "Single source of truth for encapi ENC data (statuses, roles, nodes), managed via Terraform/Terragrunt. Supersedes Cobbler node classification for Puppet."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/plan"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
description: "Spiritual successor to shorewall — nftables firewall manager using google/nftables"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Fleet control plane for tomswall firewalls. Terraform-managed API that compiles fleet-wide zones, address groups, and firewall policy into per-device tomswall configs; agents pull and differentially apply."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "HashiCorp Vault / OpenBao secrets engine issuing short-lived signed JWT app tokens (per-app roles, offline JWKS validation) for self-made services"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "HashiCorp Vault / OpenBao secrets engine for BIND TSIG keys (static rotation + dynamic creds via bind-operator)"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "HashiCorp Vault / OpenBao secrets engine for ghp: mints ephemeral, scoped access tokens via the ghp admin API, authenticating as a static admin service token"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "HashiCorp Vault / OpenBao secrets engine for Gitea: mints ephemeral, scoped per-user access tokens via the admin API, with seeded-admin basic-auth and root password rotation"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "HashiCorp Vault / OpenBao secrets engine for GPG/OpenPGP keys (sign/verify/encrypt/decrypt, transit-style versioned keys, pass-compatible)"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "HashiCorp Vault / OpenBao dynamic secrets engine for LiteLLM virtual keys"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "HashiCorp Vault / OpenBao secrets engine for NetBox API tokens (seeded admin + dynamic per-user tokens with expiry-aligned leases)"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
description: "HashiCorp Vault / OpenBao secrets engine for Rancher API tokens (seeded root rotation + dynamic scoped creds via tokens.ext.cattle.io)"
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
# Squash-only: the gitea provider has no "default merge style", so we restrict
|
|
||||||
# the allowed styles to squash to force it.
|
|
||||||
allow_merge_commits: false
|
|
||||||
allow_rebase: false
|
|
||||||
allow_rebase_explicit: false
|
|
||||||
allow_squash_merge: true
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
approval_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
description: "Monorepo of Go CLI tools for managing Vault tokens across multiple vault instances: vctl (login/renew per-context tokens) and vctx (context-aware wrapper around the vault CLI)."
|
|
||||||
private: false
|
|
||||||
default_branch: "main"
|
|
||||||
default_delete_branch_after_merge: true
|
|
||||||
default_merge_style: "squash"
|
|
||||||
branch_protection:
|
|
||||||
- rule_name: "main"
|
|
||||||
merge_whitelist_teams:
|
|
||||||
- "Owners"
|
|
||||||
enable_push: false
|
|
||||||
status_check_contexts:
|
|
||||||
- "ci/woodpecker/pr/build"
|
|
||||||
- "ci/woodpecker/pr/test"
|
|
||||||
- "ci/woodpecker/pr/pre-commit"
|
|
||||||
approval_whitelist_users:
|
|
||||||
- "benvin"
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
# Grants the unkin-agent bot Write across every unkin repository so Ben's AI
|
|
||||||
# coding agents can push benvin/* branches and open pull requests. Write is the
|
|
||||||
# minimum Gitea permission that allows pushing branches + creating PRs.
|
|
||||||
#
|
|
||||||
# Merge stays reserved for Ben: branch protection on every default branch sets a
|
|
||||||
# merge whitelist of the Owners team only, so members of this team can push and
|
|
||||||
# open PRs but cannot merge or approve. Keep this team out of every merge and
|
|
||||||
# approval whitelist.
|
|
||||||
description: "AI coding agents -- push branches + open PRs, never merge"
|
|
||||||
permission: write
|
|
||||||
include_all_repositories: true
|
|
||||||
can_create_repos: false
|
|
||||||
members:
|
|
||||||
- unkin-agent
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
description: "forgebot maintainers"
|
|
||||||
permission: none
|
|
||||||
include_all_repositories: false
|
|
||||||
can_create_repos: false
|
|
||||||
repositories:
|
|
||||||
- forgebot
|
|
||||||
- forgebot-skills
|
|
||||||
- container-agent-base
|
|
||||||
- container-agent-dev
|
|
||||||
- container-agent-infra
|
|
||||||
members:
|
|
||||||
- unkinben
|
|
||||||
- benvin
|
|
||||||
@@ -1,21 +0,0 @@
|
|||||||
# Purpose-built Gitea site-admin bot for the vault-plugin-secrets-gitea engine.
|
|
||||||
# The engine seeds itself from this account's credentials (Basic Auth) to mint
|
|
||||||
# and delete per-user tokens for any user. Its randomly generated password is
|
|
||||||
# written ONCE to Vault KV (vault_seed_path below) and never updated after; the
|
|
||||||
# Vault gitea engine reads that seed only when first creating gitea/config and
|
|
||||||
# then rotates it (rotate-root) so only Vault holds the live password.
|
|
||||||
#
|
|
||||||
# A local (not external-auth) account with 2FA disabled is required so the
|
|
||||||
# engine can change the password via the admin API during rotate-root.
|
|
||||||
email: gitea-vault-admin@unkin.net
|
|
||||||
full_name: "Gitea Vault Admin"
|
|
||||||
description: "site-admin bot; credentials seeded to Vault for vault-plugin-secrets-gitea"
|
|
||||||
# Site admin so the engine may mint/delete tokens for any user. No org/repo
|
|
||||||
# creation; profile visible only to signed-in users.
|
|
||||||
visibility: limited
|
|
||||||
admin: true
|
|
||||||
allow_create_organization: false
|
|
||||||
max_repo_creation: 0
|
|
||||||
# Seed this account's generated password to Vault KV (mount "kv") at this path,
|
|
||||||
# where the Vault gitea secrets engine reads it at creation time. Written once.
|
|
||||||
vault_seed_path: "service/vault/au/syd1/secret_backend/gitea/config"
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
# teabot "implementer" personality account.
|
|
||||||
# Used by the teabot daemon (unkin/teabot) to open issues/PRs as a distinct
|
|
||||||
# identity so its work is attributable. Auth is via an API token issued
|
|
||||||
# out-of-band (vault-plugin-secrets-gitea / static KV) -- no token or usable
|
|
||||||
# password lives in this repo's state beyond the generated placeholder.
|
|
||||||
email: teabot-implementer@unkin.net
|
|
||||||
full_name: "Teabot Implementer"
|
|
||||||
description: "teabot implementer bot -- automated agent (unkin/teabot)"
|
|
||||||
# Conservative bot posture: not a site admin, cannot create orgs or repos,
|
|
||||||
# profile visible only to signed-in users.
|
|
||||||
visibility: limited
|
|
||||||
admin: false
|
|
||||||
allow_create_organization: false
|
|
||||||
max_repo_creation: 0
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
# teabot "reviewer" personality account.
|
|
||||||
# Used by the teabot daemon (unkin/teabot) to review pull requests as a distinct
|
|
||||||
# identity so its reviews are attributable. Auth is via an API token issued
|
|
||||||
# out-of-band (vault-plugin-secrets-gitea / static KV) -- no token or usable
|
|
||||||
# password lives in this repo's state beyond the generated placeholder.
|
|
||||||
email: teabot-reviewer@unkin.net
|
|
||||||
full_name: "Teabot Reviewer"
|
|
||||||
description: "teabot reviewer bot -- automated agent (unkin/teabot)"
|
|
||||||
# Conservative bot posture: not a site admin, cannot create orgs or repos,
|
|
||||||
# profile visible only to signed-in users.
|
|
||||||
visibility: limited
|
|
||||||
admin: false
|
|
||||||
allow_create_organization: false
|
|
||||||
max_repo_creation: 0
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
# Shared identity used by Ben's AI coding agents to submit work (branches, pull
|
|
||||||
# requests, issues, comments) as a distinct, attributable, least-privilege
|
|
||||||
# account instead of Ben's own login. Auth is via ephemeral API tokens minted by
|
|
||||||
# the vault-plugin-secrets-gitea engine (gitea/creds/unkin-agent) -- no token or
|
|
||||||
# usable password lives in this repo's state beyond the generated placeholder.
|
|
||||||
#
|
|
||||||
# Write access comes from the "agents" team (team/agents.yaml); merge is blocked
|
|
||||||
# by branch protection (merge whitelist = Owners only), so the agent can open and
|
|
||||||
# comment on PRs/issues but never merge or approve.
|
|
||||||
email: unkin-agent@unkin.net
|
|
||||||
full_name: "Unkin Agent"
|
|
||||||
description: "shared identity for automated AI coding agents -- write, never merge"
|
|
||||||
# Conservative bot posture: not a site admin, cannot create orgs or repos,
|
|
||||||
# profile visible only to signed-in users.
|
|
||||||
visibility: limited
|
|
||||||
admin: false
|
|
||||||
allow_create_organization: false
|
|
||||||
max_repo_creation: 0
|
|
||||||
@@ -21,5 +21,4 @@ inputs = {
|
|||||||
repository = local.config.repository
|
repository = local.config.repository
|
||||||
branch_protection = local.config.branch_protection
|
branch_protection = local.config.branch_protection
|
||||||
team = local.config.team
|
team = local.config.team
|
||||||
user = local.config.user
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -11,15 +11,6 @@ provider "woodpecker" {
|
|||||||
server = "https://ci.k8s.syd1.au.unkin.net"
|
server = "https://ci.k8s.syd1.au.unkin.net"
|
||||||
}
|
}
|
||||||
|
|
||||||
# Address + token come from VAULT_ADDR / VAULT_TOKEN in the environment (the
|
|
||||||
# Makefile authenticates via k8s auth before running terragrunt). Used to seed
|
|
||||||
# bot-account credentials into Vault KV (see modules/user vault_seed_path).
|
|
||||||
# skip_child_token: the CI token from the k8s auth role cannot create child
|
|
||||||
# tokens (apply fails with "failed to create limited child token").
|
|
||||||
provider "vault" {
|
|
||||||
skip_child_token = true
|
|
||||||
}
|
|
||||||
|
|
||||||
terraform {
|
terraform {
|
||||||
backend "consul" {
|
backend "consul" {
|
||||||
address = "https://consul.service.consul"
|
address = "https://consul.service.consul"
|
||||||
|
|||||||
@@ -143,31 +143,6 @@ import {
|
|||||||
id = "137"
|
id = "137"
|
||||||
}
|
}
|
||||||
|
|
||||||
import {
|
|
||||||
to = module.repository["git.unkin.net/unkin/forgebot"].gitea_repository.this
|
|
||||||
id = "139"
|
|
||||||
}
|
|
||||||
|
|
||||||
import {
|
|
||||||
to = module.repository["git.unkin.net/unkin/forgebot-skills"].gitea_repository.this
|
|
||||||
id = "140"
|
|
||||||
}
|
|
||||||
|
|
||||||
import {
|
|
||||||
to = module.repository["git.unkin.net/unkin/container-agent-base"].gitea_repository.this
|
|
||||||
id = "141"
|
|
||||||
}
|
|
||||||
|
|
||||||
import {
|
|
||||||
to = module.repository["git.unkin.net/unkin/container-agent-dev"].gitea_repository.this
|
|
||||||
id = "142"
|
|
||||||
}
|
|
||||||
|
|
||||||
import {
|
|
||||||
to = module.repository["git.unkin.net/unkin/container-agent-infra"].gitea_repository.this
|
|
||||||
id = "143"
|
|
||||||
}
|
|
||||||
|
|
||||||
import {
|
import {
|
||||||
to = module.team["git.unkin.net/unkin/Owners"].gitea_team.this
|
to = module.team["git.unkin.net/unkin/Owners"].gitea_team.this
|
||||||
id = "3"
|
id = "3"
|
||||||
@@ -198,55 +173,58 @@ import {
|
|||||||
id = "12"
|
id = "12"
|
||||||
}
|
}
|
||||||
|
|
||||||
|
import {
|
||||||
|
to = module.woodpecker_repository["git.unkin.net/unkin/puppet-prod"].woodpecker_repository.this
|
||||||
|
id = "unkin/puppet-prod"
|
||||||
|
}
|
||||||
|
|
||||||
|
import {
|
||||||
|
to = module.woodpecker_repository["git.unkin.net/unkin/puppet-r10k"].woodpecker_repository.this
|
||||||
|
id = "unkin/puppet-r10k"
|
||||||
|
}
|
||||||
|
|
||||||
|
import {
|
||||||
|
to = module.woodpecker_repository["git.unkin.net/unkin/terraform-vault"].woodpecker_repository.this
|
||||||
|
id = "unkin/terraform-vault"
|
||||||
|
}
|
||||||
|
|
||||||
|
import {
|
||||||
|
to = module.woodpecker_repository["git.unkin.net/unkin/rpmbuilder"].woodpecker_repository.this
|
||||||
|
id = "unkin/rpmbuilder"
|
||||||
|
}
|
||||||
|
|
||||||
|
import {
|
||||||
|
to = module.woodpecker_repository["git.unkin.net/unkin/artifactapi"].woodpecker_repository.this
|
||||||
|
id = "unkin/artifactapi"
|
||||||
|
}
|
||||||
|
|
||||||
|
import {
|
||||||
|
to = module.woodpecker_repository["git.unkin.net/unkin/argocd-apps"].woodpecker_repository.this
|
||||||
|
id = "unkin/argocd-apps"
|
||||||
|
}
|
||||||
|
|
||||||
|
import {
|
||||||
|
to = module.woodpecker_repository["git.unkin.net/unkin/certmanager"].woodpecker_repository.this
|
||||||
|
id = "unkin/certmanager"
|
||||||
|
}
|
||||||
|
|
||||||
|
import {
|
||||||
|
to = module.woodpecker_repository["git.unkin.net/unkin/node-lookup"].woodpecker_repository.this
|
||||||
|
id = "unkin/node-lookup"
|
||||||
|
}
|
||||||
|
|
||||||
|
import {
|
||||||
|
to = module.woodpecker_repository["git.unkin.net/unkin/terraform-provider-artifactapi"].woodpecker_repository.this
|
||||||
|
id = "unkin/terraform-provider-artifactapi"
|
||||||
|
}
|
||||||
|
|
||||||
import {
|
import {
|
||||||
to = module.repository["git.unkin.net/unkin/terraform-git"].gitea_repository.this
|
to = module.repository["git.unkin.net/unkin/terraform-git"].gitea_repository.this
|
||||||
id = "144"
|
id = "144"
|
||||||
}
|
}
|
||||||
|
|
||||||
# Branch protections that already exist in Gitea but are not yet in state.
|
|
||||||
# Import id format is <organisation>/<repository>/<rule_name>.
|
|
||||||
import {
|
import {
|
||||||
to = module.branch_protection["git.unkin.net/unkin/app-sudaporn-research-individual/master"].gitea_repository_branch_protection.this
|
to = module.woodpecker_repository["git.unkin.net/unkin/terraform-git"].woodpecker_repository.this
|
||||||
id = "unkin/app-sudaporn-research-individual/master"
|
id = "unkin/terraform-git"
|
||||||
}
|
|
||||||
|
|
||||||
import {
|
|
||||||
to = module.branch_protection["git.unkin.net/unkin/app-sudaporn-research-normalised/master"].gitea_repository_branch_protection.this
|
|
||||||
id = "unkin/app-sudaporn-research-normalised/master"
|
|
||||||
}
|
|
||||||
|
|
||||||
import {
|
|
||||||
to = module.branch_protection["git.unkin.net/unkin/benvin-utils/main"].gitea_repository_branch_protection.this
|
|
||||||
id = "unkin/benvin-utils/main"
|
|
||||||
}
|
|
||||||
|
|
||||||
import {
|
|
||||||
to = module.branch_protection["git.unkin.net/unkin/container-devcompute/main"].gitea_repository_branch_protection.this
|
|
||||||
id = "unkin/container-devcompute/main"
|
|
||||||
}
|
|
||||||
|
|
||||||
import {
|
|
||||||
to = module.branch_protection["git.unkin.net/unkin/docker-template/master"].gitea_repository_branch_protection.this
|
|
||||||
id = "unkin/docker-template/master"
|
|
||||||
}
|
|
||||||
|
|
||||||
import {
|
|
||||||
to = module.branch_protection["git.unkin.net/unkin/initbuilder/main"].gitea_repository_branch_protection.this
|
|
||||||
id = "unkin/initbuilder/main"
|
|
||||||
}
|
|
||||||
|
|
||||||
import {
|
|
||||||
to = module.branch_protection["git.unkin.net/unkin/puppetapi/master"].gitea_repository_branch_protection.this
|
|
||||||
id = "unkin/puppetapi/master"
|
|
||||||
}
|
|
||||||
|
|
||||||
import {
|
|
||||||
to = module.branch_protection["git.unkin.net/unkin/rpmbuild-internal-ca-certificates/master"].gitea_repository_branch_protection.this
|
|
||||||
id = "unkin/rpmbuild-internal-ca-certificates/master"
|
|
||||||
}
|
|
||||||
|
|
||||||
import {
|
|
||||||
to = module.branch_protection["git.unkin.net/unkin/streamstack/main"].gitea_repository_branch_protection.this
|
|
||||||
id = "unkin/streamstack/main"
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -38,27 +38,6 @@ module "repository" {
|
|||||||
depends_on = [module.organisation]
|
depends_on = [module.organisation]
|
||||||
}
|
}
|
||||||
|
|
||||||
module "user" {
|
|
||||||
source = "./modules/user"
|
|
||||||
|
|
||||||
for_each = var.user
|
|
||||||
|
|
||||||
username = each.value.username
|
|
||||||
email = each.value.email
|
|
||||||
login_name = each.value.login_name
|
|
||||||
full_name = each.value.full_name
|
|
||||||
description = each.value.description
|
|
||||||
visibility = each.value.visibility
|
|
||||||
admin = each.value.admin
|
|
||||||
restricted = each.value.restricted
|
|
||||||
active = each.value.active
|
|
||||||
allow_create_organization = each.value.allow_create_organization
|
|
||||||
max_repo_creation = each.value.max_repo_creation
|
|
||||||
must_change_password = each.value.must_change_password
|
|
||||||
vault_seed_path = each.value.vault_seed_path
|
|
||||||
vault_seed_mount = each.value.vault_seed_mount
|
|
||||||
}
|
|
||||||
|
|
||||||
module "team" {
|
module "team" {
|
||||||
source = "./modules/team"
|
source = "./modules/team"
|
||||||
|
|
||||||
@@ -76,12 +55,18 @@ module "team" {
|
|||||||
depends_on = [module.organisation, module.repository]
|
depends_on = [module.organisation, module.repository]
|
||||||
}
|
}
|
||||||
|
|
||||||
removed {
|
module "woodpecker_repository" {
|
||||||
from = module.woodpecker_repository
|
source = "./modules/woodpecker_repository"
|
||||||
|
|
||||||
lifecycle {
|
for_each = {
|
||||||
destroy = false
|
for k, v in var.repository : k => v
|
||||||
|
if try(v.woodpecker, false)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
full_name = "${each.value.organisation}/${each.value.name}"
|
||||||
|
visibility = each.value.private ? "private" : "public"
|
||||||
|
|
||||||
|
depends_on = [module.repository]
|
||||||
}
|
}
|
||||||
|
|
||||||
module "branch_protection" {
|
module "branch_protection" {
|
||||||
@@ -110,7 +95,7 @@ module "branch_protection" {
|
|||||||
protected_file_patterns = each.value.protected_file_patterns
|
protected_file_patterns = each.value.protected_file_patterns
|
||||||
unprotected_file_patterns = each.value.unprotected_file_patterns
|
unprotected_file_patterns = each.value.unprotected_file_patterns
|
||||||
|
|
||||||
depends_on = [module.repository, module.team]
|
depends_on = [module.repository]
|
||||||
}
|
}
|
||||||
|
|
||||||
# TODO: enable when deploy keys are needed
|
# TODO: enable when deploy keys are needed
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ terraform {
|
|||||||
required_providers {
|
required_providers {
|
||||||
gitea = {
|
gitea = {
|
||||||
source = "go-gitea/gitea"
|
source = "go-gitea/gitea"
|
||||||
version = "0.8.1"
|
version = "0.7.0"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ terraform {
|
|||||||
required_providers {
|
required_providers {
|
||||||
gitea = {
|
gitea = {
|
||||||
source = "go-gitea/gitea"
|
source = "go-gitea/gitea"
|
||||||
version = "0.8.1"
|
version = "0.7.0"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ terraform {
|
|||||||
required_providers {
|
required_providers {
|
||||||
gitea = {
|
gitea = {
|
||||||
source = "go-gitea/gitea"
|
source = "go-gitea/gitea"
|
||||||
version = "0.8.1"
|
version = "0.7.0"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -17,9 +17,4 @@ resource "gitea_repository" "this" {
|
|||||||
website = var.website
|
website = var.website
|
||||||
autodetect_manual_merge = var.autodetect_manual_merge
|
autodetect_manual_merge = var.autodetect_manual_merge
|
||||||
archive_on_destroy = true
|
archive_on_destroy = true
|
||||||
|
|
||||||
lifecycle {
|
|
||||||
# migration_mirror_interval defaults to "8h0m0s" but Gitea returns an empty MirrorInterval for non-mirror repos, so the read-back never matches and plans a spurious update every run; it is a migration-only knob with no drift to track here.
|
|
||||||
ignore_changes = [migration_mirror_interval]
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ terraform {
|
|||||||
required_providers {
|
required_providers {
|
||||||
gitea = {
|
gitea = {
|
||||||
source = "go-gitea/gitea"
|
source = "go-gitea/gitea"
|
||||||
version = "0.8.1"
|
version = "0.7.0"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -6,11 +6,6 @@ resource "gitea_team" "this" {
|
|||||||
include_all_repositories = var.include_all_repositories
|
include_all_repositories = var.include_all_repositories
|
||||||
can_create_repos = var.can_create_repos
|
can_create_repos = var.can_create_repos
|
||||||
repositories = var.repositories
|
repositories = var.repositories
|
||||||
|
|
||||||
lifecycle {
|
|
||||||
# Gitea's SDK rejects the stored permission=none on any EditTeam call; units/repositories only churn on provider representation (unordered units string, sorted/include-all repos), so ignore them to avoid spurious edits that would fail.
|
|
||||||
ignore_changes = [permission, units, repositories]
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "gitea_team_members" "this" {
|
resource "gitea_team_members" "this" {
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ terraform {
|
|||||||
required_providers {
|
required_providers {
|
||||||
gitea = {
|
gitea = {
|
||||||
source = "go-gitea/gitea"
|
source = "go-gitea/gitea"
|
||||||
version = "0.8.1"
|
version = "0.7.0"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,58 +0,0 @@
|
|||||||
# The gitea_user resource requires a password argument. These accounts
|
|
||||||
# authenticate via API tokens (issued out-of-band by the
|
|
||||||
# vault-plugin-secrets-gitea engine, or a static KV entry initially), so the
|
|
||||||
# password is never used interactively. It is generated here so nothing
|
|
||||||
# sensitive is hardcoded, and kept only in state.
|
|
||||||
resource "random_password" "this" {
|
|
||||||
length = 32
|
|
||||||
special = true
|
|
||||||
override_special = "!@#%^&*()-_=+"
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "gitea_user" "this" {
|
|
||||||
username = var.username
|
|
||||||
login_name = coalesce(var.login_name, var.username)
|
|
||||||
email = var.email
|
|
||||||
password = random_password.this.result
|
|
||||||
|
|
||||||
full_name = var.full_name
|
|
||||||
description = var.description
|
|
||||||
visibility = var.visibility
|
|
||||||
|
|
||||||
admin = var.admin
|
|
||||||
restricted = var.restricted
|
|
||||||
active = var.active
|
|
||||||
allow_create_organization = var.allow_create_organization
|
|
||||||
max_repo_creation = var.max_repo_creation
|
|
||||||
must_change_password = var.must_change_password
|
|
||||||
|
|
||||||
# Do not e-mail the (possibly unmonitored) bot address on creation.
|
|
||||||
send_notification = false
|
|
||||||
|
|
||||||
lifecycle {
|
|
||||||
# The provider cannot read the password back from the API; ignore it so the
|
|
||||||
# account never shows perpetual drift once created.
|
|
||||||
ignore_changes = [password]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# Optional one-time seed of the account's credentials to Vault KV, for the
|
|
||||||
# vault-plugin-secrets-gitea engine to consume when it first creates gitea/config.
|
|
||||||
# random_password never regenerates (no keepers), so the seed is stable; the
|
|
||||||
# ignore_changes below makes the write strictly create-only, so a later
|
|
||||||
# rotate-root on the Vault side (which diverges the live password from this seed)
|
|
||||||
# is never clobbered by a re-apply here.
|
|
||||||
resource "vault_kv_secret_v2" "seed" {
|
|
||||||
count = var.vault_seed_path != null ? 1 : 0
|
|
||||||
|
|
||||||
mount = var.vault_seed_mount
|
|
||||||
name = var.vault_seed_path
|
|
||||||
data_json = jsonencode({
|
|
||||||
admin_username = var.username
|
|
||||||
admin_password = random_password.this.result
|
|
||||||
})
|
|
||||||
|
|
||||||
lifecycle {
|
|
||||||
ignore_changes = [data_json]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user