Merge pull request 'repository: add jellyfin-ha-src source fork' (#63) from benvin/jellyfin-ha-src into main

Reviewed-on: #63

.woodpecker/apply.yaml

@@ -7,9 +7,10 @@ steps:
     image: git.unkin.net/unkin/almalinux9-opentofu:20260606
     environment:
       VAULT_AUTH_METHOD: kubernetes
+      VAULT_VERSION: "1.20.0"
     commands:
-      - dnf install vault -y
+      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
-      - make apply-if-changes
+      - make apply
     backend_options:
       kubernetes:
         serviceAccountName: terraform-git

.woodpecker/plan.yaml

@@ -6,8 +6,9 @@ steps:
     image: git.unkin.net/unkin/almalinux9-opentofu:20260606
     environment:
       VAULT_AUTH_METHOD: kubernetes
+      VAULT_VERSION: "1.20.0"
     commands:
-      - dnf install vault -y
+      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
       - make plan
     backend_options:
       kubernetes:

config/config.hcl

@@ -33,6 +33,14 @@ locals {
       })
       if length(regexall("/team/", file_path)) > 0
     }
+    user = {
+      for file_path, content in local.all_configs :
+      "${split("/", file_path)[0]}/${trimsuffix(basename(file_path), ".yaml")}" => merge(content, {
+        username  = trimsuffix(basename(file_path), ".yaml")
+        gitea_url = split("/", file_path)[0]
+      })
+      if length(regexall("/user/", file_path)) > 0
+    }
     branch_protection = merge([
       for file_path, content in local.all_configs : {
         for idx, rule in try(content.branch_protection, []) :

config/git.unkin.net/unkin/repository/age-api.yaml

@@ -0,0 +1,16 @@
+description: "Simple API for showing a users age"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "Owners"
+    merge_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/app-sudaporn-research-individual.yaml

@@ -1,4 +1,9 @@
 description: "Sudaporn's Research Data visualisation, normalised "
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: false
+default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/app-sudaporn-research-normalised.yaml

@@ -1,4 +1,9 @@
 description: "Sudaporn's Research Data visualisation, normalised"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: false
+default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/argocd-apps.yaml

@@ -4,10 +4,12 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"
       - "ci/woodpecker/pr/kubeconform"
+      - "ci/woodpecker/pr/vector-test"
     approval_whitelist_users:
-      - "unkinben"
+      - "benvin"
-woodpecker: true

config/git.unkin.net/unkin/repository/artifactapi.yaml

@@ -5,11 +5,12 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
   - rule_name: "master"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"
       - "ci/woodpecker/pr/test"
       - "ci/woodpecker/pr/build"
     approval_whitelist_users:
-      - "unkinben"
+      - "benvin"
-woodpecker: true

config/git.unkin.net/unkin/repository/benvin-utils.yaml

@@ -0,0 +1,9 @@
+description: "Monorepo of small single-purpose CLI tools sharing a common library"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/bind-operator.yaml

@@ -0,0 +1,16 @@
+description: "Kubernetes operator for managing BIND9 DNS clusters, zones, views, and TSIG keys"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/bootapi-images.yaml

@@ -0,0 +1,15 @@
+description: "Builds AlmaLinux node rootfs tarballs for bootapi image-based provisioning; on v* tag publishes almalinux9-node-<ver>.tar.zst to the artifactapi rootfs-images repo."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/lint"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/bootapi-templates.yaml

@@ -0,0 +1,15 @@
+description: "Live kickstart/iPXE templates + distro catalog for bootapi. Pulled by bootapi via git-sync; CI validates templates render for every distro."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/validate"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/bootapi.yaml

@@ -0,0 +1,16 @@
+description: "PXE/kickstart boot service replacing Cobbler. Renders kickstart + iPXE from NetBox data over HTTP. Go API."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/cephrgw-operator.yaml

@@ -0,0 +1,16 @@
+description: "Kubernetes operator that provisions Ceph RGW (S3) buckets and access keys (RW/RO) from CRDs via the Ceph manager dashboard API"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/certmanager.yaml

@@ -1,12 +1,11 @@
 description: "Vault PKI certificate issuance and SSH host key signing tool for Puppet-managed infrastructure"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: false
+default_delete_branch_after_merge: true
 branch_protection:
   - rule_name: "master"
     enable_push: false
     merge_whitelist_users:
-      - "unkinben"
+      - "benvin"
     approval_whitelist_users:
-      - "unkinben"
+      - "benvin"
-woodpecker: true

config/git.unkin.net/unkin/repository/container-agent-base.yaml

@@ -0,0 +1,15 @@
+description: "Base container image for forgebot agents"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "docker"
+      - "forgebot"

config/git.unkin.net/unkin/repository/container-agent-dev.yaml

@@ -0,0 +1,15 @@
+description: "Dev toolchain container for forgebot agents"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "docker"
+      - "forgebot"

config/git.unkin.net/unkin/repository/container-agent-infra.yaml

@@ -0,0 +1,15 @@
+description: "Infrastructure toolchain container for forgebot agents"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "docker"
+      - "forgebot"

config/git.unkin.net/unkin/repository/container-devcompute.yaml

@@ -1,3 +1,8 @@
 description: "Docker image to be used in Kubernetes as a developers container"
 private: false
-default_delete_branch_after_merge: false
+default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/dns-updater.yaml

@@ -0,0 +1,16 @@
+description: "RFC2136 dynamic-DNS updater daemon: watches a records file and network interfaces and pushes TSIG-signed updates to BIND, with a local status API for facter."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/docker-template.yaml

@@ -3,3 +3,8 @@ private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
 repo_template: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/encapi.yaml

@@ -0,0 +1,16 @@
+description: "Postgres-backed External Node Classifier (ENC) for Puppet, replacing Cobbler. Go API + encapi-cli."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/encapic.yaml

@@ -0,0 +1,16 @@
+description: "Dependency-less Go CLI client for encapi, used as the Puppet exec External Node Classifier (ENC) on k8s compilers. Fetches the cobbler-wire ENC document and reshapes it for the puppet exec node_terminus."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/forgebot-skills.yaml

@@ -0,0 +1,14 @@
+description: "Skill definitions for forgebot agents"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/validate"
+    approval_whitelist_teams:
+      - "forgebot"
+    merge_whitelist_teams:
+      - "forgebot"

config/git.unkin.net/unkin/repository/forgebot.yaml

@@ -0,0 +1,16 @@
+description: "K8s operator + API for AI agent dispatch from git forges"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "forgebot"
+    merge_whitelist_teams:
+      - "forgebot"

config/git.unkin.net/unkin/repository/initbuilder.yaml

@@ -1,3 +1,8 @@
 description: "A repository for building initrd.img in docker "
 private: false
-default_delete_branch_after_merge: false
+default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/jellyfin-ha-src.yaml

@@ -0,0 +1,4 @@
+description: "Source fork of ZoltyMat/jellyfin-ha carrying HA patches"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true

config/git.unkin.net/unkin/repository/jellyfin-ha.yaml

@@ -0,0 +1,14 @@
+description: "Container build for the jellyfin-ha (HA transcoding) Jellyfin fork"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "docker"

config/git.unkin.net/unkin/repository/kea-operator.yaml

@@ -0,0 +1,16 @@
+description: "Kubernetes operator for managing Kea DHCP clusters, subnets, and PXE client classes"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/logarchiver.yaml

@@ -0,0 +1,16 @@
+description: "Archives raw logs from NATS JetStream to S3 as zstd-compressed, GPG-encrypted, indexed objects; plus a CLI to search and retrieve them. Go service + CLI."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/node-lookup.yaml

@@ -1,15 +1,16 @@
 description: "A CLI tool written in Go that queries the PuppetDB API to look up and filter node facts."
 private: false
-default_branch: "master"
+default_branch: "main"
 default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
-  - rule_name: "master"
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
-      - "ci/woodpecker/pr/lint"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
       - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/unit-tests"
     approval_whitelist_users:
-      - "unkinben"
+      - "benvin"
-woodpecker: true

config/git.unkin.net/unkin/repository/openbao.yaml

@@ -0,0 +1,17 @@
+description: "Private fork of OpenBao adding per-namespace raft, cross-cluster performance replicas, virtual KV, and KV events"
+private: true
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    # Whitelist-push: the owner can push main directly (needed for the initial
+    # push and the fork's maintenance workflow); everyone else must open a PR.
+    enable_push: true
+    push_whitelist_users:
+      - "unkinben"
+    # PRs to main must pass the fork build/vet pipeline before merge.
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"

config/git.unkin.net/unkin/repository/passv.yaml

@@ -0,0 +1,21 @@
+description: "Vault-backed drop-in replacement for pass (password-store); routes GPG crypto through vault-plugin-secrets-gpg"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/pdbmux.yaml

@@ -0,0 +1,16 @@
+description: "Merging HTTP proxy over two PuppetDB backends, presenting a single merged PuppetDB v4 query surface during the VM to k8s Puppet migration. Deployed in-cluster via argocd-apps."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/puppet-prod.yaml

@@ -35,4 +35,3 @@ branch_protection:
       - "ci/woodpecker/pr/yamllint"
     approval_whitelist_teams:
       - "puppet"
-woodpecker: true

config/git.unkin.net/unkin/repository/puppet-r10k.yaml

@@ -13,4 +13,3 @@ branch_protection:
     approval_whitelist_teams:
       - "puppet"
     block_on_rejected_reviews: true
-woodpecker: true

config/git.unkin.net/unkin/repository/puppetapi.yaml

@@ -2,3 +2,8 @@ description: "A fastapi service to present puppet services via an api"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/rpmbuild-internal-ca-certificates.yaml

@@ -1,4 +1,9 @@
 description: "Package the internal ca-certificates"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: false
+default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "master"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/rpmbuild-jellyfin-web.yaml

@@ -1,5 +1,5 @@
 description: "Build rpms for jellyfin-web"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: false
+default_delete_branch_after_merge: true
 archived: true

config/git.unkin.net/unkin/repository/rpmbuilder.yaml

@@ -18,4 +18,3 @@ branch_protection:
     approval_whitelist_teams:
       - "rpmbuild"
     block_on_rejected_reviews: true
-woodpecker: true

config/git.unkin.net/unkin/repository/streamstack.yaml

@@ -1,3 +1,8 @@
 description: "A stack of microservices that aim to offer a distributed streaming service."
 private: false
-default_delete_branch_after_merge: false
+default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/teabot.yaml

@@ -0,0 +1,16 @@
+description: "A Go daemon that watches Gitea repos and dispatches one-shot Claude Code sessions in Docker to work issues and review PRs."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/terraform-artifactapi.yaml

@@ -0,0 +1,18 @@
+description: "Terraform configuration for managing ArtifactAPI remote and virtual repositories"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    merge_whitelist_users:
+      - "benvin"
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "benvin"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-authentik.yaml

@@ -0,0 +1,18 @@
+description: "Terraform configuration for managing Authentik identity provider"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    merge_whitelist_users:
+      - "benvin"
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "benvin"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-git.yaml

@@ -1,14 +1,16 @@
 description: "Manage Gitea resources, teams, repos, and Woodpecker CI via Terraform"
 private: false
 default_branch: "main"
-woodpecker: true
+default_delete_branch_after_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"
       - "ci/woodpecker/pr/plan"
     approval_whitelist_users:
-      - "unkinben"
+      - "benvin"
     approval_whitelist_teams:
       - "Owners"

config/git.unkin.net/unkin/repository/terraform-infra.yaml

@@ -0,0 +1,16 @@
+description: "YAML-driven Terraform for NetBox IPAM, networks, and devices + Kea DHCP"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "benvin"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-nomad.yaml

@@ -1,7 +1,7 @@
 description: "Manage nomad with Terraform"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: false
+default_delete_branch_after_merge: true
 branch_protection:
   - rule_name: "master"
     enable_push: false

config/git.unkin.net/unkin/repository/terraform-provider-artifactapi.yaml

@@ -1,9 +1,14 @@
 description: "Terraform provider for managing ArtifactAPI"
 private: false
-default_delete_branch_after_merge: false
+default_delete_branch_after_merge: true
 branch_protection:
   - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
     enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
     approval_whitelist_teams:
       - "Owners"
-woodpecker: true

config/git.unkin.net/unkin/repository/terraform-provider-encapi.yaml

@@ -0,0 +1,16 @@
+description: "Terraform provider for encapi: manage Puppet ENC roles, statuses, and node assignments."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/terraform-provider-giteavaultsecret.yaml

@@ -0,0 +1,21 @@
+description: "Terraform provider for the Vault/OpenBao Gitea token secrets engine (giteavaultsecret)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-provider-gpgvaultsecret.yaml

@@ -0,0 +1,21 @@
+description: "Terraform provider for the Vault/OpenBao GPG/OpenPGP secrets engine (gpgvaultsecret) — manage backends and keys"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-provider-kea.yaml

@@ -0,0 +1,16 @@
+description: "Terraform provider for the kea-operator KeaAPI: manage Kea DHCP subnets and PXE client classes."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/terraform-provider-litellmvaultsecret.yaml

@@ -0,0 +1,21 @@
+description: "Terraform provider for the Vault/OpenBao LiteLLM dynamic secrets engine (litellmvaultsecret)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml

@@ -0,0 +1,21 @@
+description: "Terraform provider for the Vault/OpenBao Rancher token secrets engine (ranchervaultsecret)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-provider-tomswallapi.yaml

@@ -0,0 +1,16 @@
+description: "Terraform provider for tomswallapi: manage fleet-global firewall policy (zones, address groups, portgroups, rules, policies, fabrics) and per-device bindings."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/terraform-provider-vault-secrets-netbox.yaml

@@ -0,0 +1,21 @@
+description: "Terraform provider for the Vault/OpenBao NetBox token secrets engine (pairs with vault-plugin-secrets-netbox)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-prowlarr.yaml

@@ -0,0 +1,18 @@
+description: "Terraform configuration for managing Prowlarr indexer automation"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    merge_whitelist_users:
+      - "benvin"
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "benvin"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-radarr.yaml

@@ -0,0 +1,18 @@
+description: "Terraform configuration for managing Radarr movie automation"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    merge_whitelist_users:
+      - "benvin"
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "benvin"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-rancher.yaml

@@ -0,0 +1,18 @@
+description: "Terraform configuration for managing Rancher (auth, roles) via the rancher2 provider"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    merge_whitelist_users:
+      - "benvin"
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "benvin"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-sonarr.yaml

@@ -0,0 +1,18 @@
+description: "Terraform configuration for managing Sonarr TV automation"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    merge_whitelist_users:
+      - "benvin"
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "benvin"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-vault.yaml

@@ -13,7 +13,6 @@ branch_protection:
       - "ci/woodpecker/pr/pre-commit"
       - "ci/woodpecker/pr/plan"
     approval_whitelist_users:
-      - "unkinben"
+      - "benvin"
     approval_whitelist_teams:
       - "Owners"
-woodpecker: true

config/git.unkin.net/unkin/repository/terragrunt-enc.yaml

@@ -0,0 +1,15 @@
+description: "Single source of truth for encapi ENC data (statuses, roles, nodes), managed via Terraform/Terragrunt. Supersedes Cobbler node classification for Puppet."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/tomswall.yaml

@@ -0,0 +1,10 @@
+description: "Spiritual successor to shorewall — nftables firewall manager using google/nftables"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false

config/git.unkin.net/unkin/repository/tomswallapi.yaml

@@ -0,0 +1,16 @@
+description: "Fleet control plane for tomswall firewalls. Terraform-managed API that compiles fleet-wide zones, address groups, and firewall policy into per-device tomswall configs; agents pull and differentially apply."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-apptoken.yaml

@@ -0,0 +1,21 @@
+description: "HashiCorp Vault / OpenBao secrets engine issuing short-lived signed JWT app tokens (per-app roles, offline JWKS validation) for self-made services"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-bind-tsig.yaml

@@ -0,0 +1,21 @@
+description: "HashiCorp Vault / OpenBao secrets engine for BIND TSIG keys (static rotation + dynamic creds via bind-operator)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-gitea.yaml

@@ -0,0 +1,21 @@
+description: "HashiCorp Vault / OpenBao secrets engine for Gitea: mints ephemeral, scoped per-user access tokens via the admin API, with seeded-admin basic-auth and root password rotation"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-gpg.yaml

@@ -0,0 +1,21 @@
+description: "HashiCorp Vault / OpenBao secrets engine for GPG/OpenPGP keys (sign/verify/encrypt/decrypt, transit-style versioned keys, pass-compatible)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-litellm.yaml

@@ -0,0 +1,21 @@
+description: "HashiCorp Vault / OpenBao dynamic secrets engine for LiteLLM virtual keys"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-netbox.yaml

@@ -0,0 +1,21 @@
+description: "HashiCorp Vault / OpenBao secrets engine for NetBox API tokens (seeded admin + dynamic per-user tokens with expiry-aligned leases)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml

@@ -0,0 +1,21 @@
+description: "HashiCorp Vault / OpenBao secrets engine for Rancher API tokens (seeded root rotation + dynamic scoped creds via tokens.ext.cattle.io)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/vault-tools.yaml

@@ -0,0 +1,16 @@
+description: "Monorepo of Go CLI tools for managing Vault tokens across multiple vault instances: vctl (login/renew per-context tokens) and vctx (context-aware wrapper around the vault CLI)."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/team/agents.yaml

@@ -0,0 +1,14 @@
+# Grants the unkin-agent bot Write across every unkin repository so Ben's AI
+# coding agents can push benvin/* branches and open pull requests. Write is the
+# minimum Gitea permission that allows pushing branches + creating PRs.
+#
+# Merge stays reserved for Ben: branch protection on every default branch sets a
+# merge whitelist of the Owners team only, so members of this team can push and
+# open PRs but cannot merge or approve. Keep this team out of every merge and
+# approval whitelist.
+description: "AI coding agents -- push branches + open PRs, never merge"
+permission: write
+include_all_repositories: true
+can_create_repos: false
+members:
+  - unkin-agent

config/git.unkin.net/unkin/team/forgebot.yaml

@@ -0,0 +1,13 @@
+description: "forgebot maintainers"
+permission: none
+include_all_repositories: false
+can_create_repos: false
+repositories:
+  - forgebot
+  - forgebot-skills
+  - container-agent-base
+  - container-agent-dev
+  - container-agent-infra
+members:
+  - unkinben
+  - benvin

config/git.unkin.net/user/gitea-vault-admin.yaml

@@ -0,0 +1,21 @@
+# Purpose-built Gitea site-admin bot for the vault-plugin-secrets-gitea engine.
+# The engine seeds itself from this account's credentials (Basic Auth) to mint
+# and delete per-user tokens for any user. Its randomly generated password is
+# written ONCE to Vault KV (vault_seed_path below) and never updated after; the
+# Vault gitea engine reads that seed only when first creating gitea/config and
+# then rotates it (rotate-root) so only Vault holds the live password.
+#
+# A local (not external-auth) account with 2FA disabled is required so the
+# engine can change the password via the admin API during rotate-root.
+email: gitea-vault-admin@unkin.net
+full_name: "Gitea Vault Admin"
+description: "site-admin bot; credentials seeded to Vault for vault-plugin-secrets-gitea"
+# Site admin so the engine may mint/delete tokens for any user. No org/repo
+# creation; profile visible only to signed-in users.
+visibility: limited
+admin: true
+allow_create_organization: false
+max_repo_creation: 0
+# Seed this account's generated password to Vault KV (mount "kv") at this path,
+# where the Vault gitea secrets engine reads it at creation time. Written once.
+vault_seed_path: "service/vault/au/syd1/secret_backend/gitea/config"

config/git.unkin.net/user/teabot-implementer.yaml

@@ -0,0 +1,14 @@
+# teabot "implementer" personality account.
+# Used by the teabot daemon (unkin/teabot) to open issues/PRs as a distinct
+# identity so its work is attributable. Auth is via an API token issued
+# out-of-band (vault-plugin-secrets-gitea / static KV) -- no token or usable
+# password lives in this repo's state beyond the generated placeholder.
+email: teabot-implementer@unkin.net
+full_name: "Teabot Implementer"
+description: "teabot implementer bot -- automated agent (unkin/teabot)"
+# Conservative bot posture: not a site admin, cannot create orgs or repos,
+# profile visible only to signed-in users.
+visibility: limited
+admin: false
+allow_create_organization: false
+max_repo_creation: 0

config/git.unkin.net/user/teabot-reviewer.yaml

@@ -0,0 +1,14 @@
+# teabot "reviewer" personality account.
+# Used by the teabot daemon (unkin/teabot) to review pull requests as a distinct
+# identity so its reviews are attributable. Auth is via an API token issued
+# out-of-band (vault-plugin-secrets-gitea / static KV) -- no token or usable
+# password lives in this repo's state beyond the generated placeholder.
+email: teabot-reviewer@unkin.net
+full_name: "Teabot Reviewer"
+description: "teabot reviewer bot -- automated agent (unkin/teabot)"
+# Conservative bot posture: not a site admin, cannot create orgs or repos,
+# profile visible only to signed-in users.
+visibility: limited
+admin: false
+allow_create_organization: false
+max_repo_creation: 0

config/git.unkin.net/user/unkin-agent.yaml

@@ -0,0 +1,18 @@
+# Shared identity used by Ben's AI coding agents to submit work (branches, pull
+# requests, issues, comments) as a distinct, attributable, least-privilege
+# account instead of Ben's own login. Auth is via ephemeral API tokens minted by
+# the vault-plugin-secrets-gitea engine (gitea/creds/unkin-agent) -- no token or
+# usable password lives in this repo's state beyond the generated placeholder.
+#
+# Write access comes from the "agents" team (team/agents.yaml); merge is blocked
+# by branch protection (merge whitelist = Owners only), so the agent can open and
+# comment on PRs/issues but never merge or approve.
+email: unkin-agent@unkin.net
+full_name: "Unkin Agent"
+description: "shared identity for automated AI coding agents -- write, never merge"
+# Conservative bot posture: not a site admin, cannot create orgs or repos,
+# profile visible only to signed-in users.
+visibility: limited
+admin: false
+allow_create_organization: false
+max_repo_creation: 0

environments/au/syd1/terragrunt.hcl

@@ -21,4 +21,5 @@ inputs = {
   repository        = local.config.repository
   branch_protection = local.config.branch_protection
   team              = local.config.team
+  user              = local.config.user
 }

environments/root.hcl

@@ -11,6 +11,15 @@ provider "woodpecker" {
   server = "https://ci.k8s.syd1.au.unkin.net"
 }
 
+# Address + token come from VAULT_ADDR / VAULT_TOKEN in the environment (the
+# Makefile authenticates via k8s auth before running terragrunt). Used to seed
+# bot-account credentials into Vault KV (see modules/user vault_seed_path).
+# skip_child_token: the CI token from the k8s auth role cannot create child
+# tokens (apply fails with "failed to create limited child token").
+provider "vault" {
+  skip_child_token = true
+}
+
 terraform {
   backend "consul" {
     address = "https://consul.service.consul"

modules/gitea_instance/imports.tf

@@ -143,6 +143,31 @@ import {
   id = "137"
 }
 
+import {
+  to = module.repository["git.unkin.net/unkin/forgebot"].gitea_repository.this
+  id = "139"
+}
+
+import {
+  to = module.repository["git.unkin.net/unkin/forgebot-skills"].gitea_repository.this
+  id = "140"
+}
+
+import {
+  to = module.repository["git.unkin.net/unkin/container-agent-base"].gitea_repository.this
+  id = "141"
+}
+
+import {
+  to = module.repository["git.unkin.net/unkin/container-agent-dev"].gitea_repository.this
+  id = "142"
+}
+
+import {
+  to = module.repository["git.unkin.net/unkin/container-agent-infra"].gitea_repository.this
+  id = "143"
+}
+
 import {
   to = module.team["git.unkin.net/unkin/Owners"].gitea_team.this
   id = "3"
@@ -173,58 +198,55 @@ import {
   id = "12"
 }
 
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/puppet-prod"].woodpecker_repository.this
-  id = "unkin/puppet-prod"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/puppet-r10k"].woodpecker_repository.this
-  id = "unkin/puppet-r10k"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-vault"].woodpecker_repository.this
-  id = "unkin/terraform-vault"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/rpmbuilder"].woodpecker_repository.this
-  id = "unkin/rpmbuilder"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/artifactapi"].woodpecker_repository.this
-  id = "unkin/artifactapi"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/argocd-apps"].woodpecker_repository.this
-  id = "unkin/argocd-apps"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/certmanager"].woodpecker_repository.this
-  id = "unkin/certmanager"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/node-lookup"].woodpecker_repository.this
-  id = "unkin/node-lookup"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-provider-artifactapi"].woodpecker_repository.this
-  id = "unkin/terraform-provider-artifactapi"
-}
-
 import {
   to = module.repository["git.unkin.net/unkin/terraform-git"].gitea_repository.this
   id = "144"
 }
 
+# Branch protections that already exist in Gitea but are not yet in state.
+# Import id format is <organisation>/<repository>/<rule_name>.
 import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-git"].woodpecker_repository.this
+  to = module.branch_protection["git.unkin.net/unkin/app-sudaporn-research-individual/master"].gitea_repository_branch_protection.this
-  id = "unkin/terraform-git"
+  id = "unkin/app-sudaporn-research-individual/master"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/app-sudaporn-research-normalised/master"].gitea_repository_branch_protection.this
+  id = "unkin/app-sudaporn-research-normalised/master"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/benvin-utils/main"].gitea_repository_branch_protection.this
+  id = "unkin/benvin-utils/main"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/container-devcompute/main"].gitea_repository_branch_protection.this
+  id = "unkin/container-devcompute/main"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/docker-template/master"].gitea_repository_branch_protection.this
+  id = "unkin/docker-template/master"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/initbuilder/main"].gitea_repository_branch_protection.this
+  id = "unkin/initbuilder/main"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/puppetapi/master"].gitea_repository_branch_protection.this
+  id = "unkin/puppetapi/master"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/rpmbuild-internal-ca-certificates/master"].gitea_repository_branch_protection.this
+  id = "unkin/rpmbuild-internal-ca-certificates/master"
+}
+
+import {
+  to = module.branch_protection["git.unkin.net/unkin/streamstack/main"].gitea_repository_branch_protection.this
+  id = "unkin/streamstack/main"
 }
 

modules/gitea_instance/main.tf

@@ -38,6 +38,27 @@ module "repository" {
   depends_on = [module.organisation]
 }
 
+module "user" {
+  source = "./modules/user"
+
+  for_each = var.user
+
+  username                  = each.value.username
+  email                     = each.value.email
+  login_name                = each.value.login_name
+  full_name                 = each.value.full_name
+  description               = each.value.description
+  visibility                = each.value.visibility
+  admin                     = each.value.admin
+  restricted                = each.value.restricted
+  active                    = each.value.active
+  allow_create_organization = each.value.allow_create_organization
+  max_repo_creation         = each.value.max_repo_creation
+  must_change_password      = each.value.must_change_password
+  vault_seed_path           = each.value.vault_seed_path
+  vault_seed_mount          = each.value.vault_seed_mount
+}
+
 module "team" {
   source = "./modules/team"
 
@@ -55,18 +76,12 @@ module "team" {
   depends_on = [module.organisation, module.repository]
 }
 
-module "woodpecker_repository" {
+removed {
-  source = "./modules/woodpecker_repository"
+  from = module.woodpecker_repository
 
-  for_each = {
+  lifecycle {
-    for k, v in var.repository : k => v
+    destroy = false
-    if try(v.woodpecker, false)
   }
-
-  full_name  = "${each.value.organisation}/${each.value.name}"
-  visibility = each.value.private ? "private" : "public"
-
-  depends_on = [module.repository]
 }
 
 module "branch_protection" {
@@ -95,7 +110,7 @@ module "branch_protection" {
   protected_file_patterns           = each.value.protected_file_patterns
   unprotected_file_patterns         = each.value.unprotected_file_patterns
 
-  depends_on = [module.repository]
+  depends_on = [module.repository, module.team]
 }
 
 # TODO: enable when deploy keys are needed

modules/gitea_instance/modules/branch_protection/terraform.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     gitea = {
       source  = "go-gitea/gitea"
-      version = "0.7.0"
+      version = "0.8.1"
     }
   }
 }

modules/gitea_instance/modules/deploy_key/terraform.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     gitea = {
       source  = "go-gitea/gitea"
-      version = "0.7.0"
+      version = "0.8.1"
     }
   }
 }

modules/gitea_instance/modules/organisation/terraform.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     gitea = {
       source  = "go-gitea/gitea"
-      version = "0.7.0"
+      version = "0.8.1"
     }
   }
 }

modules/gitea_instance/modules/repository/terraform.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     gitea = {
       source  = "go-gitea/gitea"
-      version = "0.7.0"
+      version = "0.8.1"
     }
   }
 }

modules/gitea_instance/modules/team/main.tf

@@ -6,6 +6,11 @@ resource "gitea_team" "this" {
   include_all_repositories = var.include_all_repositories
   can_create_repos         = var.can_create_repos
   repositories             = var.repositories
+
+  lifecycle {
+    # Gitea's SDK rejects the stored permission=none on any EditTeam call; units/repositories only churn on provider representation (unordered units string, sorted/include-all repos), so ignore them to avoid spurious edits that would fail.
+    ignore_changes = [permission, units, repositories]
+  }
 }
 
 resource "gitea_team_members" "this" {

modules/gitea_instance/modules/team/terraform.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     gitea = {
       source  = "go-gitea/gitea"
-      version = "0.7.0"
+      version = "0.8.1"
     }
   }
 }

modules/gitea_instance/modules/user/main.tf

@@ -0,0 +1,58 @@
+# The gitea_user resource requires a password argument. These accounts
+# authenticate via API tokens (issued out-of-band by the
+# vault-plugin-secrets-gitea engine, or a static KV entry initially), so the
+# password is never used interactively. It is generated here so nothing
+# sensitive is hardcoded, and kept only in state.
+resource "random_password" "this" {
+  length           = 32
+  special          = true
+  override_special = "!@#%^&*()-_=+"
+}
+
+resource "gitea_user" "this" {
+  username   = var.username
+  login_name = coalesce(var.login_name, var.username)
+  email      = var.email
+  password   = random_password.this.result
+
+  full_name   = var.full_name
+  description = var.description
+  visibility  = var.visibility
+
+  admin                     = var.admin
+  restricted                = var.restricted
+  active                    = var.active
+  allow_create_organization = var.allow_create_organization
+  max_repo_creation         = var.max_repo_creation
+  must_change_password      = var.must_change_password
+
+  # Do not e-mail the (possibly unmonitored) bot address on creation.
+  send_notification = false
+
+  lifecycle {
+    # The provider cannot read the password back from the API; ignore it so the
+    # account never shows perpetual drift once created.
+    ignore_changes = [password]
+  }
+}
+
+# Optional one-time seed of the account's credentials to Vault KV, for the
+# vault-plugin-secrets-gitea engine to consume when it first creates gitea/config.
+# random_password never regenerates (no keepers), so the seed is stable; the
+# ignore_changes below makes the write strictly create-only, so a later
+# rotate-root on the Vault side (which diverges the live password from this seed)
+# is never clobbered by a re-apply here.
+resource "vault_kv_secret_v2" "seed" {
+  count = var.vault_seed_path != null ? 1 : 0
+
+  mount = var.vault_seed_mount
+  name  = var.vault_seed_path
+  data_json = jsonencode({
+    admin_username = var.username
+    admin_password = random_password.this.result
+  })
+
+  lifecycle {
+    ignore_changes = [data_json]
+  }
+}

modules/gitea_instance/modules/user/terraform.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    gitea = {
+      source  = "go-gitea/gitea"
+      version = "0.8.1"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.5"
+    }
+    vault = {
+      source  = "hashicorp/vault"
+      version = ">= 4.3"
+    }
+  }
+}

modules/gitea_instance/modules/user/variables.tf

@@ -0,0 +1,87 @@
+variable "username" {
+  description = "Username of the Gitea account (immutable; changing it recreates the user)"
+  type        = string
+}
+
+variable "login_name" {
+  description = "Login name, may differ from username. Defaults to the username."
+  type        = string
+  default     = null
+}
+
+variable "email" {
+  description = "E-Mail address of the user"
+  type        = string
+}
+
+variable "full_name" {
+  description = "Display / full name of the user"
+  type        = string
+  default     = ""
+}
+
+variable "description" {
+  description = "Profile description of the user"
+  type        = string
+  default     = ""
+}
+
+variable "visibility" {
+  description = "Profile visibility: public, limited or private"
+  type        = string
+  default     = "limited"
+}
+
+variable "admin" {
+  description = "Whether the user is a site administrator"
+  type        = bool
+  default     = false
+}
+
+variable "restricted" {
+  description = "Restricted users can only access repositories/orgs they are explicitly added to"
+  type        = bool
+  default     = false
+}
+
+variable "active" {
+  description = "Whether the account is active"
+  type        = bool
+  default     = true
+}
+
+variable "allow_create_organization" {
+  description = "Whether the user may create organisations"
+  type        = bool
+  default     = false
+}
+
+variable "max_repo_creation" {
+  description = "Maximum number of repositories the user may create (0 disallows creation)"
+  type        = number
+  default     = 0
+}
+
+variable "must_change_password" {
+  description = "Force a password change on first login"
+  type        = bool
+  default     = false
+}
+
+variable "vault_seed_path" {
+  description = <<-EOT
+    Optional. When set, the account's generated password is seeded ONCE to Vault
+    KV at this secret name (under vault_seed_mount) as admin_username +
+    admin_password, for the vault-plugin-secrets-gitea engine to consume at
+    creation time. The write is create-only; subsequent changes are ignored so
+    the seed never churns (and never overwrites a rotated password).
+  EOT
+  type        = string
+  default     = null
+}
+
+variable "vault_seed_mount" {
+  description = "KV v2 mount holding the seeded credential (used only when vault_seed_path is set)"
+  type        = string
+  default     = "kv"
+}

modules/gitea_instance/modules/woodpecker_repository/main.tf

@@ -1,4 +0,0 @@
-resource "woodpecker_repository" "this" {
-  full_name  = var.full_name
-  visibility = var.visibility
-}

modules/gitea_instance/modules/woodpecker_repository/terraform.tf

@@ -1,9 +0,0 @@
-terraform {
-  required_version = ">= 1.10"
-  required_providers {
-    woodpecker = {
-      source  = "Kichiyaki/woodpecker"
-      version = "0.5.0"
-    }
-  }
-}

modules/gitea_instance/modules/woodpecker_repository/variables.tf

@@ -1,8 +0,0 @@
-variable "full_name" {
-  type = string
-}
-
-variable "visibility" {
-  type    = string
-  default = "internal"
-}

modules/gitea_instance/terraform.tf

@@ -3,11 +3,19 @@ terraform {
   required_providers {
     gitea = {
       source  = "go-gitea/gitea"
-      version = "0.7.0"
+      version = "0.8.1"
     }
     woodpecker = {
       source  = "Kichiyaki/woodpecker"
       version = "0.5.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.5"
+    }
+    vault = {
+      source  = "hashicorp/vault"
+      version = ">= 4.3"
+    }
   }
 }

modules/gitea_instance/variables.tf

@@ -32,7 +32,6 @@ variable "repository" {
     repo_template           = optional(bool)
     website                 = optional(string)
     autodetect_manual_merge = optional(bool)
-    woodpecker              = optional(bool, false)
   }))
   default = {}
 }
@@ -65,6 +64,27 @@ variable "branch_protection" {
 }
 
 
+variable "user" {
+  description = "Map of Gitea user accounts to create"
+  type = map(object({
+    username                  = string
+    email                     = string
+    login_name                = optional(string)
+    full_name                 = optional(string, "")
+    description               = optional(string, "")
+    visibility                = optional(string, "limited")
+    admin                     = optional(bool, false)
+    restricted                = optional(bool, false)
+    active                    = optional(bool, true)
+    allow_create_organization = optional(bool, false)
+    max_repo_creation         = optional(number, 0)
+    must_change_password      = optional(bool, false)
+    vault_seed_path           = optional(string)
+    vault_seed_mount          = optional(string, "kv")
+  }))
+  default = {}
+}
+
 variable "team" {
   description = "Map of teams to create"
   type = map(object({