Merge branch 'main' into benvin/update1

- add new repo
- change write -> none

.woodpecker/apply.yaml

@@ -7,10 +7,9 @@ steps:
     image: git.unkin.net/unkin/almalinux9-opentofu:20260606
     environment:
       VAULT_AUTH_METHOD: kubernetes
-      VAULT_VERSION: "1.20.0"
     commands:
-      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
+      - dnf install vault -y
-      - make apply
+      - make apply-if-changes
     backend_options:
       kubernetes:
         serviceAccountName: terraform-git

.woodpecker/plan.yaml

@@ -6,9 +6,8 @@ steps:
     image: git.unkin.net/unkin/almalinux9-opentofu:20260606
     environment:
       VAULT_AUTH_METHOD: kubernetes
-      VAULT_VERSION: "1.20.0"
     commands:
-      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
+      - dnf install vault -y
       - make plan
     backend_options:
       kubernetes:

config/git.unkin.net/unkin/repository/age-api.yaml

@@ -1,16 +0,0 @@
-description: "Simple API for showing a users age"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "Owners"
-    merge_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/app-sudaporn-research-individual.yaml

@@ -1,4 +1,4 @@
 description: "Sudaporn's Research Data visualisation, normalised "
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false

config/git.unkin.net/unkin/repository/app-sudaporn-research-normalised.yaml

@@ -1,4 +1,4 @@
 description: "Sudaporn's Research Data visualisation, normalised"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false

config/git.unkin.net/unkin/repository/argocd-apps.yaml

@@ -9,4 +9,5 @@ branch_protection:
       - "ci/woodpecker/pr/pre-commit"
       - "ci/woodpecker/pr/kubeconform"
     approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true

config/git.unkin.net/unkin/repository/artifactapi.yaml

@@ -11,4 +11,5 @@ branch_protection:
       - "ci/woodpecker/pr/test"
       - "ci/woodpecker/pr/build"
     approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true

config/git.unkin.net/unkin/repository/benvin-utils.yaml

@@ -1,4 +0,0 @@
-description: "Monorepo of small single-purpose CLI tools sharing a common library"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true

config/git.unkin.net/unkin/repository/bind-operator.yaml

@@ -1,14 +0,0 @@
-description: "Kubernetes operator for managing BIND9 DNS clusters, zones, views, and TSIG keys"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/cephrgw-operator.yaml

@@ -1,14 +0,0 @@
-description: "Kubernetes operator that provisions Ceph RGW (S3) buckets and access keys (RW/RO) from CRDs via the Ceph manager dashboard API"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/repository/certmanager.yaml

@@ -1,11 +1,12 @@
 description: "Vault PKI certificate issuance and SSH host key signing tool for Puppet-managed infrastructure"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 branch_protection:
   - rule_name: "master"
     enable_push: false
     merge_whitelist_users:
-      - "benvin"
+      - "unkinben"
     approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true

config/git.unkin.net/unkin/repository/container-agent-base.yaml

@@ -1,13 +0,0 @@
-description: "Base container image for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
-      - "forgebot"

config/git.unkin.net/unkin/repository/container-agent-dev.yaml

@@ -1,13 +0,0 @@
-description: "Dev toolchain container for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
-      - "forgebot"

config/git.unkin.net/unkin/repository/container-agent-infra.yaml

@@ -1,13 +0,0 @@
-description: "Infrastructure toolchain container for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
-      - "forgebot"

config/git.unkin.net/unkin/repository/container-devcompute.yaml

@@ -1,3 +1,3 @@
 description: "Docker image to be used in Kubernetes as a developers container"
 private: false
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false

config/git.unkin.net/unkin/repository/dns-updater.yaml

@@ -1,14 +0,0 @@
-description: "RFC2136 dynamic-DNS updater daemon: watches a records file and network interfaces and pushes TSIG-signed updates to BIND, with a local status API for facter."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/repository/encapi.yaml

@@ -1,14 +0,0 @@
-description: "Postgres-backed External Node Classifier (ENC) for Puppet, replacing Cobbler. Go API + encapi-cli."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/repository/encapic.yaml

@@ -1,14 +0,0 @@
-description: "Dependency-less Go CLI client for encapi, used as the Puppet exec External Node Classifier (ENC) on k8s compilers. Fetches the cobbler-wire ENC document and reshapes it for the puppet exec node_terminus."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/repository/forgebot-skills.yaml

@@ -1,14 +0,0 @@
-description: "Skill definitions for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/validate"
-    approval_whitelist_teams:
-      - "forgebot"
-    merge_whitelist_teams:
-      - "forgebot"

config/git.unkin.net/unkin/repository/forgebot.yaml

@@ -1,16 +0,0 @@
-description: "K8s operator + API for AI agent dispatch from git forges"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "forgebot"
-    merge_whitelist_teams:
-      - "forgebot"

config/git.unkin.net/unkin/repository/initbuilder.yaml

@@ -1,3 +1,3 @@
 description: "A repository for building initrd.img in docker "
 private: false
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false

config/git.unkin.net/unkin/repository/jellyfin-ha.yaml

@@ -1,12 +0,0 @@
-description: "Container build for the jellyfin-ha (HA transcoding) Jellyfin fork"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"

config/git.unkin.net/unkin/repository/node-lookup.yaml

@@ -1,14 +1,15 @@
 description: "A CLI tool written in Go that queries the PuppetDB API to look up and filter node facts."
 private: false
-default_branch: "main"
+default_branch: "master"
 default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
-  - rule_name: "main"
+  - rule_name: "master"
     enable_push: false
     status_check_contexts:
-      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/lint"
-      - "ci/woodpecker/pr/test"
       - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/unit-tests"
     approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true

config/git.unkin.net/unkin/repository/openbao.yaml

@@ -1,15 +0,0 @@
-description: "Private fork of OpenBao adding per-namespace raft, cross-cluster performance replicas, virtual KV, and KV events"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    # Whitelist-push: the owner can push main directly (needed for the initial
-    # push and the fork's maintenance workflow); everyone else must open a PR.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    # PRs to main must pass the fork build/vet pipeline before merge.
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/passv.yaml

@@ -1,19 +0,0 @@
-description: "Vault-backed drop-in replacement for pass (password-store); routes GPG crypto through vault-plugin-secrets-gpg"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/pdbmux.yaml

@@ -1,14 +0,0 @@
-description: "Merging HTTP proxy over two PuppetDB backends, presenting a single merged PuppetDB v4 query surface during the VM to k8s Puppet migration. Deployed in-cluster via argocd-apps."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/repository/puppet-prod.yaml

@@ -35,3 +35,4 @@ branch_protection:
       - "ci/woodpecker/pr/yamllint"
     approval_whitelist_teams:
       - "puppet"
+woodpecker: true

config/git.unkin.net/unkin/repository/puppet-r10k.yaml

@@ -13,3 +13,4 @@ branch_protection:
     approval_whitelist_teams:
       - "puppet"
     block_on_rejected_reviews: true
+woodpecker: true

config/git.unkin.net/unkin/repository/rpmbuild-internal-ca-certificates.yaml

@@ -1,4 +1,4 @@
 description: "Package the internal ca-certificates"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false

config/git.unkin.net/unkin/repository/rpmbuild-jellyfin-web.yaml

@@ -1,5 +1,5 @@
 description: "Build rpms for jellyfin-web"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 archived: true

config/git.unkin.net/unkin/repository/rpmbuilder.yaml

@@ -18,3 +18,4 @@ branch_protection:
     approval_whitelist_teams:
       - "rpmbuild"
     block_on_rejected_reviews: true
+woodpecker: true

config/git.unkin.net/unkin/repository/streamstack.yaml

@@ -1,3 +1,3 @@
 description: "A stack of microservices that aim to offer a distributed streaming service."
 private: false
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false

config/git.unkin.net/unkin/repository/teabot.yaml

@@ -1,14 +0,0 @@
-description: "A Go daemon that watches Gitea repos and dispatches one-shot Claude Code sessions in Docker to work issues and review PRs."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/repository/terraform-artifactapi.yaml

@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing ArtifactAPI remote and virtual repositories"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/terraform-authentik.yaml

@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Authentik identity provider"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/terraform-git.yaml

@@ -1,7 +1,7 @@
 description: "Manage Gitea resources, teams, repos, and Woodpecker CI via Terraform"
 private: false
 default_branch: "main"
-default_delete_branch_after_merge: true
+woodpecker: true
 branch_protection:
   - rule_name: "main"
     enable_push: false
@@ -9,6 +9,6 @@ branch_protection:
       - "ci/woodpecker/pr/pre-commit"
       - "ci/woodpecker/pr/plan"
     approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
     approval_whitelist_teams:
       - "Owners"

config/git.unkin.net/unkin/repository/terraform-nomad.yaml

@@ -1,7 +1,7 @@
 description: "Manage nomad with Terraform"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 branch_protection:
   - rule_name: "master"
     enable_push: false

config/git.unkin.net/unkin/repository/terraform-provider-artifactapi.yaml

@@ -1,12 +1,9 @@
 description: "Terraform provider for managing ArtifactAPI"
 private: false
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 branch_protection:
   - rule_name: "main"
     enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
     approval_whitelist_teams:
       - "Owners"
+woodpecker: true

config/git.unkin.net/unkin/repository/terraform-provider-encapi.yaml

@@ -1,14 +0,0 @@
-description: "Terraform provider for encapi: manage Puppet ENC roles, statuses, and node assignments."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/repository/terraform-provider-gpgvaultsecret.yaml

@@ -1,19 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao GPG/OpenPGP secrets engine (gpgvaultsecret) — manage backends and keys"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/terraform-provider-litellmvaultsecret.yaml

@@ -1,19 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao LiteLLM dynamic secrets engine (litellmvaultsecret)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml

@@ -1,19 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao Rancher token secrets engine (ranchervaultsecret)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/terraform-provider-tomswallapi.yaml

@@ -1,14 +0,0 @@
-description: "Terraform provider for tomswallapi: manage fleet-global firewall policy (zones, address groups, portgroups, rules, policies, fabrics) and per-device bindings."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/repository/terraform-prowlarr.yaml

@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Prowlarr indexer automation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/terraform-radarr.yaml

@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Radarr movie automation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/terraform-rancher.yaml

@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Rancher (auth, roles) via the rancher2 provider"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/terraform-sonarr.yaml

@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Sonarr TV automation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/terraform-vault.yaml

@@ -13,6 +13,7 @@ branch_protection:
       - "ci/woodpecker/pr/pre-commit"
       - "ci/woodpecker/pr/plan"
     approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
     approval_whitelist_teams:
       - "Owners"
+woodpecker: true

config/git.unkin.net/unkin/repository/terragrunt-enc.yaml

@@ -1,13 +0,0 @@
-description: "Single source of truth for encapi ENC data (statuses, roles, nodes), managed via Terraform/Terragrunt. Supersedes Cobbler node classification for Puppet."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/repository/tomswall.yaml

@@ -1,8 +0,0 @@
-description: "Spiritual successor to shorewall — nftables firewall manager using google/nftables"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false

config/git.unkin.net/unkin/repository/tomswallapi.yaml

@@ -1,14 +0,0 @@
-description: "Fleet control plane for tomswall firewalls. Terraform-managed API that compiles fleet-wide zones, address groups, and firewall policy into per-device tomswall configs; agents pull and differentially apply."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-bind-tsig.yaml

@@ -1,19 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for BIND TSIG keys (static rotation + dynamic creds via bind-operator)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-gpg.yaml

@@ -1,19 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for GPG/OpenPGP keys (sign/verify/encrypt/decrypt, transit-style versioned keys, pass-compatible)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-litellm.yaml

@@ -1,19 +0,0 @@
-description: "HashiCorp Vault / OpenBao dynamic secrets engine for LiteLLM virtual keys"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml

@@ -1,19 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for Rancher API tokens (seeded root rotation + dynamic scoped creds via tokens.ext.cattle.io)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"

config/git.unkin.net/unkin/repository/vault-tools.yaml

@@ -1,14 +0,0 @@
-description: "Monorepo of Go CLI tools for managing Vault tokens across multiple vault instances: vctl (login/renew per-context tokens) and vctx (context-aware wrapper around the vault CLI)."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"

config/git.unkin.net/unkin/team/forgebot.yaml

@@ -1,13 +0,0 @@
-description: "forgebot maintainers"
-permission: none
-include_all_repositories: false
-can_create_repos: false
-repositories:
-  - forgebot
-  - forgebot-skills
-  - container-agent-base
-  - container-agent-dev
-  - container-agent-infra
-members:
-  - unkinben
-  - benvin

modules/gitea_instance/imports.tf

@@ -143,31 +143,6 @@ import {
   id = "137"
 }
 
-import {
-  to = module.repository["git.unkin.net/unkin/forgebot"].gitea_repository.this
-  id = "139"
-}
-
-import {
-  to = module.repository["git.unkin.net/unkin/forgebot-skills"].gitea_repository.this
-  id = "140"
-}
-
-import {
-  to = module.repository["git.unkin.net/unkin/container-agent-base"].gitea_repository.this
-  id = "141"
-}
-
-import {
-  to = module.repository["git.unkin.net/unkin/container-agent-dev"].gitea_repository.this
-  id = "142"
-}
-
-import {
-  to = module.repository["git.unkin.net/unkin/container-agent-infra"].gitea_repository.this
-  id = "143"
-}
-
 import {
   to = module.team["git.unkin.net/unkin/Owners"].gitea_team.this
   id = "3"
@@ -198,8 +173,58 @@ import {
   id = "12"
 }
 
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/puppet-prod"].woodpecker_repository.this
+  id = "unkin/puppet-prod"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/puppet-r10k"].woodpecker_repository.this
+  id = "unkin/puppet-r10k"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-vault"].woodpecker_repository.this
+  id = "unkin/terraform-vault"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/rpmbuilder"].woodpecker_repository.this
+  id = "unkin/rpmbuilder"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/artifactapi"].woodpecker_repository.this
+  id = "unkin/artifactapi"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/argocd-apps"].woodpecker_repository.this
+  id = "unkin/argocd-apps"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/certmanager"].woodpecker_repository.this
+  id = "unkin/certmanager"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/node-lookup"].woodpecker_repository.this
+  id = "unkin/node-lookup"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-provider-artifactapi"].woodpecker_repository.this
+  id = "unkin/terraform-provider-artifactapi"
+}
+
 import {
   to = module.repository["git.unkin.net/unkin/terraform-git"].gitea_repository.this
   id = "144"
 }
 
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-git"].woodpecker_repository.this
+  id = "unkin/terraform-git"
+}
+

modules/gitea_instance/main.tf

@@ -55,12 +55,18 @@ module "team" {
   depends_on = [module.organisation, module.repository]
 }
 
-removed {
+module "woodpecker_repository" {
-  from = module.woodpecker_repository
+  source = "./modules/woodpecker_repository"
 
-  lifecycle {
+  for_each = {
-    destroy = false
+    for k, v in var.repository : k => v
+    if try(v.woodpecker, false)
   }
+
+  full_name  = "${each.value.organisation}/${each.value.name}"
+  visibility = each.value.private ? "private" : "public"
+
+  depends_on = [module.repository]
 }
 
 module "branch_protection" {
@@ -89,7 +95,7 @@ module "branch_protection" {
   protected_file_patterns           = each.value.protected_file_patterns
   unprotected_file_patterns         = each.value.unprotected_file_patterns
 
-  depends_on = [module.repository, module.team]
+  depends_on = [module.repository]
 }
 
 # TODO: enable when deploy keys are needed

modules/gitea_instance/modules/team/main.tf

@@ -6,10 +6,6 @@ resource "gitea_team" "this" {
   include_all_repositories = var.include_all_repositories
   can_create_repos         = var.can_create_repos
   repositories             = var.repositories
-
-  lifecycle {
-    ignore_changes = [permission]
-  }
 }
 
 resource "gitea_team_members" "this" {

modules/gitea_instance/modules/woodpecker_repository/main.tf

@@ -0,0 +1,4 @@
+resource "woodpecker_repository" "this" {
+  full_name  = var.full_name
+  visibility = var.visibility
+}

modules/gitea_instance/modules/woodpecker_repository/terraform.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    woodpecker = {
+      source  = "Kichiyaki/woodpecker"
+      version = "0.5.0"
+    }
+  }
+}

modules/gitea_instance/modules/woodpecker_repository/variables.tf

@@ -0,0 +1,8 @@
+variable "full_name" {
+  type = string
+}
+
+variable "visibility" {
+  type    = string
+  default = "internal"
+}

modules/gitea_instance/variables.tf

@@ -32,6 +32,7 @@ variable "repository" {
     repo_template           = optional(bool)
     website                 = optional(string)
     autodetect_manual_merge = optional(bool)
+    woodpecker              = optional(bool, false)
   }))
   default = {}
 }