Merge branch 'main' into benvin/update1

feat: add terraform-git
- add new repo - change write -> none
2026-06-11 23:32:17 +10:00 · 2026-06-11 00:52:50 +10:00
108 changed files with 120 additions and 1520 deletions
@@ -7,10 +7,9 @@ steps:
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
-      VAULT_VERSION: "1.20.0"
    commands:
-      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
-      - make apply
+      - dnf install vault -y
+      - make apply-if-changes
    backend_options:
      kubernetes:
        serviceAccountName: terraform-git
@@ -6,9 +6,8 @@ steps:
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
-      VAULT_VERSION: "1.20.0"
    commands:
-      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
+      - dnf install vault -y
      - make plan
    backend_options:
      kubernetes:
@@ -33,14 +33,6 @@ locals {
      })
      if length(regexall("/team/", file_path)) > 0
    }
-    user = {
-      for file_path, content in local.all_configs :
-      "${split("/", file_path)[0]}/${trimsuffix(basename(file_path), ".yaml")}" => merge(content, {
-        username  = trimsuffix(basename(file_path), ".yaml")
-        gitea_url = split("/", file_path)[0]
-      })
-      if length(regexall("/user/", file_path)) > 0
-    }
    branch_protection = merge([
      for file_path, content in local.all_configs : {
        for idx, rule in try(content.branch_protection, []) :
@@ -1,16 +0,0 @@
-description: "Simple API for showing a users age"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "Owners"
-    merge_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "CLI tools for orchestrator PR automation as unkin-agent"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,9 +1,4 @@
 description: "Sudaporn's Research Data visualisation, normalised "
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,9 +1,4 @@
 description: "Sudaporn's Research Data visualisation, normalised"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -4,12 +4,10 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
    enable_push: false
    status_check_contexts:
      - "ci/woodpecker/pr/pre-commit"
      - "ci/woodpecker/pr/kubeconform"
-      - "ci/woodpecker/pr/vector-test"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true
@@ -1,16 +0,0 @@
-description: "arrstack reverse proxy: oauth2-gated UI + per-user API-key broker"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -5,12 +5,11 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
  - rule_name: "master"
-    merge_whitelist_teams:
-      - "Owners"
    enable_push: false
    status_check_contexts:
      - "ci/woodpecker/pr/pre-commit"
      - "ci/woodpecker/pr/test"
      - "ci/woodpecker/pr/build"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true
@@ -1,16 +0,0 @@
-description: "Kubernetes operator that provisions S3 buckets and backup schedules from backups.unkin.net/* annotations on PVCs and CNPG clusters"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,9 +0,0 @@
-description: "Monorepo of small single-purpose CLI tools sharing a common library"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Kubernetes operator for managing BIND9 DNS clusters, zones, views, and TSIG keys"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,15 +0,0 @@
-description: "Builds AlmaLinux node rootfs tarballs for bootapi image-based provisioning; on v* tag publishes almalinux9-node-<ver>.tar.zst to the artifactapi rootfs-images repo."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/lint"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,15 +0,0 @@
-description: "Live kickstart/iPXE templates + distro catalog for bootapi. Pulled by bootapi via git-sync; CI validates templates render for every distro."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/validate"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,16 +0,0 @@
-description: "PXE/kickstart boot service replacing Cobbler. Renders kickstart + iPXE from NetBox data over HTTP. Go API."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,16 +0,0 @@
-description: "Kubernetes operator that provisions Ceph RGW (S3) buckets and access keys (RW/RO) from CRDs via the Ceph manager dashboard API"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,11 +1,12 @@
 description: "Vault PKI certificate issuance and SSH host key signing tool for Puppet-managed infrastructure"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 branch_protection:
  - rule_name: "master"
    enable_push: false
    merge_whitelist_users:
-      - "benvin"
+      - "unkinben"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true
@@ -1,15 +0,0 @@
-description: "Base container image for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
-      - "forgebot"
@@ -1,15 +0,0 @@
-description: "Dev toolchain container for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
-      - "forgebot"
@@ -1,15 +0,0 @@
-description: "Infrastructure toolchain container for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
-      - "forgebot"
@@ -1,8 +1,3 @@
 description: "Docker image to be used in Kubernetes as a developers container"
 private: false
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,16 +0,0 @@
-description: "RFC2136 dynamic-DNS updater daemon: watches a records file and network interfaces and pushes TSIG-signed updates to BIND, with a local status API for facter."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -3,8 +3,3 @@ private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
 repo_template: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Postgres-backed External Node Classifier (ENC) for Puppet, replacing Cobbler. Go API + encapi-cli."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,16 +0,0 @@
-description: "Dependency-less Go CLI client for encapi, used as the Puppet exec External Node Classifier (ENC) on k8s compilers. Fetches the cobbler-wire ENC document and reshapes it for the puppet exec node_terminus."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,14 +0,0 @@
-description: "Skill definitions for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/validate"
-    approval_whitelist_teams:
-      - "forgebot"
-    merge_whitelist_teams:
-      - "forgebot"
@@ -1,16 +0,0 @@
-description: "K8s operator + API for AI agent dispatch from git forges"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "forgebot"
-    merge_whitelist_teams:
-      - "forgebot"
@@ -1,17 +0,0 @@
-description: "Fork of goodtune/ghp (GitHub proxy) with unkin patches"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Whitelist-push: the owner can push main directly (needed for the initial
-    # push and the fork's maintenance workflow); everyone else must open a PR.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    # PRs to main must pass the fork build/vet pipeline before merge.
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
@@ -1,8 +1,3 @@
 description: "A repository for building initrd.img in docker "
 private: false
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,11 +0,0 @@
-description: "Source fork of ZoltyMat/jellyfin-ha carrying HA patches"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/ci"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,14 +0,0 @@
-description: "Container build for the jellyfin-ha (HA transcoding) Jellyfin fork"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
@@ -1,16 +0,0 @@
-description: "Kubernetes operator for managing Kea DHCP clusters, subnets, and PXE client classes"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Archives raw logs from NATS JetStream to S3 as zstd-compressed, GPG-encrypted, indexed objects; plus a CLI to search and retrieve them. Go service + CLI."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,16 +1,15 @@
 description: "A CLI tool written in Go that queries the PuppetDB API to look up and filter node facts."
 private: false
-default_branch: "main"
+default_branch: "master"
 default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
+  - rule_name: "master"
    enable_push: false
    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/lint"
      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/unit-tests"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true
@@ -1,17 +0,0 @@
-description: "Private fork of OpenBao adding per-namespace raft, cross-cluster performance replicas, virtual KV, and KV events"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Whitelist-push: the owner can push main directly (needed for the initial
-    # push and the fork's maintenance workflow); everyone else must open a PR.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    # PRs to main must pass the fork build/vet pipeline before merge.
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
@@ -1,21 +0,0 @@
-description: "Vault-backed drop-in replacement for pass (password-store); routes GPG crypto through vault-plugin-secrets-gpg"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Merging HTTP proxy over two PuppetDB backends, presenting a single merged PuppetDB v4 query surface during the VM to k8s Puppet migration. Deployed in-cluster via argocd-apps."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,14 +0,0 @@
-description: "Woodpecker plugin-docker-buildx image with the internal Vault-PKI CA baked in (trusts artifactapi)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
@@ -1,16 +0,0 @@
-description: "Private fork of Prowlarr: Postgres backend + stateless multi-replica for the arrstack"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Owner can push main directly for fork maintenance (upstream-fix merges);
-    # everyone else opens a PR that must pass the Woodpecker image build.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/docker"
@@ -35,3 +35,4 @@ branch_protection:
      - "ci/woodpecker/pr/yamllint"
    approval_whitelist_teams:
      - "puppet"
+woodpecker: true
@@ -13,3 +13,4 @@ branch_protection:
    approval_whitelist_teams:
      - "puppet"
    block_on_rejected_reviews: true
+woodpecker: true
@@ -2,8 +2,3 @@ description: "A fastapi service to present puppet services via an api"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Private fork of Radarr: Postgres backend + stateless multi-replica for the arrstack"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Owner can push main directly for fork maintenance (upstream-fix merges);
-    # everyone else opens a PR that must pass the Woodpecker image build.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/docker"
@@ -1,9 +1,4 @@
 description: "Package the internal ca-certificates"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,5 +1,5 @@
 description: "Build rpms for jellyfin-web"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 archived: true
@@ -18,3 +18,4 @@ branch_protection:
    approval_whitelist_teams:
      - "rpmbuild"
    block_on_rejected_reviews: true
+woodpecker: true
@@ -1,16 +0,0 @@
-description: "Private fork of Sonarr: Postgres backend + stateless multi-replica for the arrstack"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Owner can push main directly for fork maintenance (upstream-fix merges);
-    # everyone else opens a PR that must pass the Woodpecker image build.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/docker"
@@ -1,8 +1,3 @@
 description: "A stack of microservices that aim to offer a distributed streaming service."
 private: false
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,16 +0,0 @@
-description: "A Go daemon that watches Gitea repos and dispatches one-shot Claude Code sessions in Docker to work issues and review PRs."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing ArtifactAPI remote and virtual repositories"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Authentik identity provider"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +1,14 @@
 description: "Manage Gitea resources, teams, repos, and Woodpecker CI via Terraform"
 private: false
 default_branch: "main"
-default_delete_branch_after_merge: true
+woodpecker: true
 branch_protection:
  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
    enable_push: false
    status_check_contexts:
      - "ci/woodpecker/pr/pre-commit"
      - "ci/woodpecker/pr/plan"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
    approval_whitelist_teams:
      - "Owners"
@@ -1,16 +0,0 @@
-description: "YAML-driven Terraform for NetBox IPAM, networks, and devices + Kea DHCP"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,7 +1,7 @@
 description: "Manage nomad with Terraform"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 branch_protection:
  - rule_name: "master"
    enable_push: false
@@ -1,14 +1,9 @@
 description: "Terraform provider for managing ArtifactAPI"
 private: false
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 branch_protection:
  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
    approval_whitelist_teams:
      - "Owners"
+woodpecker: true
@@ -1,16 +0,0 @@
-description: "Terraform provider for encapi: manage Puppet ENC roles, statuses, and node assignments."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao Gitea token secrets engine (giteavaultsecret)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao GPG/OpenPGP secrets engine (gpgvaultsecret) — manage backends and keys"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Terraform provider for the kea-operator KeaAPI: manage Kea DHCP subnets and PXE client classes."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao LiteLLM dynamic secrets engine (litellmvaultsecret)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao Rancher token secrets engine (ranchervaultsecret)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Terraform provider for tomswallapi: manage fleet-global firewall policy (zones, address groups, portgroups, rules, policies, fabrics) and per-device bindings."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao ghp token secrets engine (vault-secrets-ghp)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao NetBox token secrets engine (pairs with vault-plugin-secrets-netbox)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Prowlarr indexer automation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Radarr movie automation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Rancher (auth, roles) via the rancher2 provider"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Sonarr TV automation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -13,6 +13,7 @@ branch_protection:
      - "ci/woodpecker/pr/pre-commit"
      - "ci/woodpecker/pr/plan"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
    approval_whitelist_teams:
      - "Owners"
+woodpecker: true
@@ -1,15 +0,0 @@
-description: "Single source of truth for encapi ENC data (statuses, roles, nodes), managed via Terraform/Terragrunt. Supersedes Cobbler node classification for Puppet."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,10 +0,0 @@
-description: "Spiritual successor to shorewall — nftables firewall manager using google/nftables"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
@@ -1,16 +0,0 @@
-description: "Fleet control plane for tomswall firewalls. Terraform-managed API that compiles fleet-wide zones, address groups, and firewall policy into per-device tomswall configs; agents pull and differentially apply."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine issuing short-lived signed JWT app tokens (per-app roles, offline JWKS validation) for self-made services"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "Vault/OpenBao secrets engine minting dynamic arrproxy per-user API tokens"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for BIND TSIG keys (static rotation + dynamic creds via bind-operator)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for ghp: mints ephemeral, scoped access tokens via the ghp admin API, authenticating as a static admin service token"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for Gitea: mints ephemeral, scoped per-user access tokens via the admin API, with seeded-admin basic-auth and root password rotation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for GPG/OpenPGP keys (sign/verify/encrypt/decrypt, transit-style versioned keys, pass-compatible)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao dynamic secrets engine for LiteLLM virtual keys"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for NetBox API tokens (seeded admin + dynamic per-user tokens with expiry-aligned leases)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for Rancher API tokens (seeded root rotation + dynamic scoped creds via tokens.ext.cattle.io)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Monorepo of Go CLI tools for managing Vault tokens across multiple vault instances: vctl (login/renew per-context tokens) and vctx (context-aware wrapper around the vault CLI)."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,14 +0,0 @@
-# Grants the unkin-agent bot Write across every unkin repository so Ben's AI
-# coding agents can push benvin/* branches and open pull requests. Write is the
-# minimum Gitea permission that allows pushing branches + creating PRs.
-#
-# Merge stays reserved for Ben: branch protection on every default branch sets a
-# merge whitelist of the Owners team only, so members of this team can push and
-# open PRs but cannot merge or approve. Keep this team out of every merge and
-# approval whitelist.
-description: "AI coding agents -- push branches + open PRs, never merge"
-permission: write
-include_all_repositories: true
-can_create_repos: false
-members:
-  - unkin-agent
@@ -1,13 +0,0 @@
-description: "forgebot maintainers"
-permission: none
-include_all_repositories: false
-can_create_repos: false
-repositories:
-  - forgebot
-  - forgebot-skills
-  - container-agent-base
-  - container-agent-dev
-  - container-agent-infra
-members:
-  - unkinben
-  - benvin
@@ -1,21 +0,0 @@
-# Purpose-built Gitea site-admin bot for the vault-plugin-secrets-gitea engine.
-# The engine seeds itself from this account's credentials (Basic Auth) to mint
-# and delete per-user tokens for any user. Its randomly generated password is
-# written ONCE to Vault KV (vault_seed_path below) and never updated after; the
-# Vault gitea engine reads that seed only when first creating gitea/config and
-# then rotates it (rotate-root) so only Vault holds the live password.
-#
-# A local (not external-auth) account with 2FA disabled is required so the
-# engine can change the password via the admin API during rotate-root.
-email: gitea-vault-admin@unkin.net
-full_name: "Gitea Vault Admin"
-description: "site-admin bot; credentials seeded to Vault for vault-plugin-secrets-gitea"
-# Site admin so the engine may mint/delete tokens for any user. No org/repo
-# creation; profile visible only to signed-in users.
-visibility: limited
-admin: true
-allow_create_organization: false
-max_repo_creation: 0
-# Seed this account's generated password to Vault KV (mount "kv") at this path,
-# where the Vault gitea secrets engine reads it at creation time. Written once.
-vault_seed_path: "service/vault/au/syd1/secret_backend/gitea/config"
@@ -1,14 +0,0 @@
-# teabot "implementer" personality account.
-# Used by the teabot daemon (unkin/teabot) to open issues/PRs as a distinct
-# identity so its work is attributable. Auth is via an API token issued
-# out-of-band (vault-plugin-secrets-gitea / static KV) -- no token or usable
-# password lives in this repo's state beyond the generated placeholder.
-email: teabot-implementer@unkin.net
-full_name: "Teabot Implementer"
-description: "teabot implementer bot -- automated agent (unkin/teabot)"
-# Conservative bot posture: not a site admin, cannot create orgs or repos,
-# profile visible only to signed-in users.
-visibility: limited
-admin: false
-allow_create_organization: false
-max_repo_creation: 0
@@ -1,14 +0,0 @@
-# teabot "reviewer" personality account.
-# Used by the teabot daemon (unkin/teabot) to review pull requests as a distinct
-# identity so its reviews are attributable. Auth is via an API token issued
-# out-of-band (vault-plugin-secrets-gitea / static KV) -- no token or usable
-# password lives in this repo's state beyond the generated placeholder.
-email: teabot-reviewer@unkin.net
-full_name: "Teabot Reviewer"
-description: "teabot reviewer bot -- automated agent (unkin/teabot)"
-# Conservative bot posture: not a site admin, cannot create orgs or repos,
-# profile visible only to signed-in users.
-visibility: limited
-admin: false
-allow_create_organization: false
-max_repo_creation: 0
@@ -1,18 +0,0 @@
-# Shared identity used by Ben's AI coding agents to submit work (branches, pull
-# requests, issues, comments) as a distinct, attributable, least-privilege
-# account instead of Ben's own login. Auth is via ephemeral API tokens minted by
-# the vault-plugin-secrets-gitea engine (gitea/creds/unkin-agent) -- no token or
-# usable password lives in this repo's state beyond the generated placeholder.
-#
-# Write access comes from the "agents" team (team/agents.yaml); merge is blocked
-# by branch protection (merge whitelist = Owners only), so the agent can open and
-# comment on PRs/issues but never merge or approve.
-email: unkin-agent@unkin.net
-full_name: "Unkin Agent"
-description: "shared identity for automated AI coding agents -- write, never merge"
-# Conservative bot posture: not a site admin, cannot create orgs or repos,
-# profile visible only to signed-in users.
-visibility: limited
-admin: false
-allow_create_organization: false
-max_repo_creation: 0
@@ -21,5 +21,4 @@ inputs = {
  repository        = local.config.repository
  branch_protection = local.config.branch_protection
  team              = local.config.team
-  user              = local.config.user
 }
@@ -11,15 +11,6 @@ provider "woodpecker" {
  server = "https://ci.k8s.syd1.au.unkin.net"
 }

-# Address + token come from VAULT_ADDR / VAULT_TOKEN in the environment (the
-# Makefile authenticates via k8s auth before running terragrunt). Used to seed
-# bot-account credentials into Vault KV (see modules/user vault_seed_path).
-# skip_child_token: the CI token from the k8s auth role cannot create child
-# tokens (apply fails with "failed to create limited child token").
-provider "vault" {
-  skip_child_token = true
-}
-
 terraform {
  backend "consul" {
    address = "https://consul.service.consul"
@@ -143,31 +143,6 @@ import {
  id = "137"
 }

-import {
-  to = module.repository["git.unkin.net/unkin/forgebot"].gitea_repository.this
-  id = "139"
-}
-
-import {
-  to = module.repository["git.unkin.net/unkin/forgebot-skills"].gitea_repository.this
-  id = "140"
-}
-
-import {
-  to = module.repository["git.unkin.net/unkin/container-agent-base"].gitea_repository.this
-  id = "141"
-}
-
-import {
-  to = module.repository["git.unkin.net/unkin/container-agent-dev"].gitea_repository.this
-  id = "142"
-}
-
-import {
-  to = module.repository["git.unkin.net/unkin/container-agent-infra"].gitea_repository.this
-  id = "143"
-}
-
 import {
  to = module.team["git.unkin.net/unkin/Owners"].gitea_team.this
  id = "3"
@@ -198,55 +173,58 @@ import {
  id = "12"
 }

+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/puppet-prod"].woodpecker_repository.this
+  id = "unkin/puppet-prod"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/puppet-r10k"].woodpecker_repository.this
+  id = "unkin/puppet-r10k"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-vault"].woodpecker_repository.this
+  id = "unkin/terraform-vault"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/rpmbuilder"].woodpecker_repository.this
+  id = "unkin/rpmbuilder"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/artifactapi"].woodpecker_repository.this
+  id = "unkin/artifactapi"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/argocd-apps"].woodpecker_repository.this
+  id = "unkin/argocd-apps"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/certmanager"].woodpecker_repository.this
+  id = "unkin/certmanager"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/node-lookup"].woodpecker_repository.this
+  id = "unkin/node-lookup"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-provider-artifactapi"].woodpecker_repository.this
+  id = "unkin/terraform-provider-artifactapi"
+}
+
 import {
  to = module.repository["git.unkin.net/unkin/terraform-git"].gitea_repository.this
  id = "144"
 }

-# Branch protections that already exist in Gitea but are not yet in state.
-# Import id format is <organisation>/<repository>/<rule_name>.
 import {
-  to = module.branch_protection["git.unkin.net/unkin/app-sudaporn-research-individual/master"].gitea_repository_branch_protection.this
-  id = "unkin/app-sudaporn-research-individual/master"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/app-sudaporn-research-normalised/master"].gitea_repository_branch_protection.this
-  id = "unkin/app-sudaporn-research-normalised/master"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/benvin-utils/main"].gitea_repository_branch_protection.this
-  id = "unkin/benvin-utils/main"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/container-devcompute/main"].gitea_repository_branch_protection.this
-  id = "unkin/container-devcompute/main"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/docker-template/master"].gitea_repository_branch_protection.this
-  id = "unkin/docker-template/master"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/initbuilder/main"].gitea_repository_branch_protection.this
-  id = "unkin/initbuilder/main"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/puppetapi/master"].gitea_repository_branch_protection.this
-  id = "unkin/puppetapi/master"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/rpmbuild-internal-ca-certificates/master"].gitea_repository_branch_protection.this
-  id = "unkin/rpmbuild-internal-ca-certificates/master"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/streamstack/main"].gitea_repository_branch_protection.this
-  id = "unkin/streamstack/main"
+  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-git"].woodpecker_repository.this
+  id = "unkin/terraform-git"
 }

@@ -38,27 +38,6 @@ module "repository" {
  depends_on = [module.organisation]
 }

-module "user" {
-  source = "./modules/user"
-
-  for_each = var.user
-
-  username                  = each.value.username
-  email                     = each.value.email
-  login_name                = each.value.login_name
-  full_name                 = each.value.full_name
-  description               = each.value.description
-  visibility                = each.value.visibility
-  admin                     = each.value.admin
-  restricted                = each.value.restricted
-  active                    = each.value.active
-  allow_create_organization = each.value.allow_create_organization
-  max_repo_creation         = each.value.max_repo_creation
-  must_change_password      = each.value.must_change_password
-  vault_seed_path           = each.value.vault_seed_path
-  vault_seed_mount          = each.value.vault_seed_mount
-}
-
 module "team" {
  source = "./modules/team"

@@ -76,12 +55,18 @@ module "team" {
  depends_on = [module.organisation, module.repository]
 }

-removed {
-  from = module.woodpecker_repository
+module "woodpecker_repository" {
+  source = "./modules/woodpecker_repository"

-  lifecycle {
-    destroy = false
+  for_each = {
+    for k, v in var.repository : k => v
+    if try(v.woodpecker, false)
  }
+
+  full_name  = "${each.value.organisation}/${each.value.name}"
+  visibility = each.value.private ? "private" : "public"
+
+  depends_on = [module.repository]
 }

 module "branch_protection" {
@@ -110,7 +95,7 @@ module "branch_protection" {
  protected_file_patterns           = each.value.protected_file_patterns
  unprotected_file_patterns         = each.value.unprotected_file_patterns

-  depends_on = [module.repository, module.team]
+  depends_on = [module.repository]
 }

 # TODO: enable when deploy keys are needed
@@ -3,7 +3,7 @@ terraform {
  required_providers {
    gitea = {
      source  = "go-gitea/gitea"
-      version = "0.8.1"
+      version = "0.7.0"
    }
  }
 }
@@ -3,7 +3,7 @@ terraform {
  required_providers {
    gitea = {
      source  = "go-gitea/gitea"
-      version = "0.8.1"
+      version = "0.7.0"
    }
  }
 }
@@ -3,7 +3,7 @@ terraform {
  required_providers {
    gitea = {
      source  = "go-gitea/gitea"
-      version = "0.8.1"
+      version = "0.7.0"
    }
  }
 }
@@ -17,9 +17,4 @@ resource "gitea_repository" "this" {
  website                 = var.website
  autodetect_manual_merge = var.autodetect_manual_merge
  archive_on_destroy      = true
-
-  lifecycle {
-    # migration_mirror_interval defaults to "8h0m0s" but Gitea returns an empty MirrorInterval for non-mirror repos, so the read-back never matches and plans a spurious update every run; it is a migration-only knob with no drift to track here.
-    ignore_changes = [migration_mirror_interval]
-  }
 }
@@ -3,7 +3,7 @@ terraform {
  required_providers {
    gitea = {
      source  = "go-gitea/gitea"
-      version = "0.8.1"
+      version = "0.7.0"
    }
  }
 }
@@ -6,11 +6,6 @@ resource "gitea_team" "this" {
  include_all_repositories = var.include_all_repositories
  can_create_repos         = var.can_create_repos
  repositories             = var.repositories
-
-  lifecycle {
-    # Gitea's SDK rejects the stored permission=none on any EditTeam call; units/repositories only churn on provider representation (unordered units string, sorted/include-all repos), so ignore them to avoid spurious edits that would fail.
-    ignore_changes = [permission, units, repositories]
-  }
 }

 resource "gitea_team_members" "this" {
@@ -3,7 +3,7 @@ terraform {
  required_providers {
    gitea = {
      source  = "go-gitea/gitea"
-      version = "0.8.1"
+      version = "0.7.0"
    }
  }
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
benvin	5c784eff19	Merge branch 'main' into benvin/update1 ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details	2026-06-11 23:32:17 +10:00
unkinben	cee451f741	feat: add terraform-git ci/woodpecker/pr/pre-commit Pipeline failed Details ci/woodpecker/pr/plan Pipeline was successful Details - add new repo - change write -> none	2026-06-11 00:52:50 +10:00