Why:
- The go-gitea/gitea provider stores branch-protection whitelist users/teams as
plain names, but Gitea resolves them to IDs and, on read, returns them via
getWhitelistEntities over the repo's readers: users ordered by user ID, teams
ordered by name, and any entity without read access to the repo silently
dropped.
- So the read-back representation of push/merge/approval whitelists rarely
matches the config list (order differs, or a whitelisted user/team that lacks
repo access disappears), and tofu plans an in-place update for those branch
protections on every run even with no config change.
- This is the same class of provider representation churn already handled for
teams in #62 (units/repositories), and it blocks a clean plan on terraform-git.
Change:
- Add a targeted ignore_changes on the six whitelist list attributes
(push/merge/approval, users and teams) at the branch_protection module so the
churn no longer triggers a spurious update, keeping every protected repo
idempotent.
- Leave enable_push, required_approvals, status_check_patterns and the
block_merge_on_* flags managed; those round-trip cleanly and stay drift-checked.
Now that the source fork is seeded on main with the pinned upstream tree and a
pristine upstream ref, enable branch protection on main: block direct pushes
and require an Owners approval so future changes land through reviewed pull
requests.
Add the jellyfin-ha-src Gitea repository that carries the HA source fork of
ZoltyMat/jellyfin-ha with local patches, replacing the direct upstream clone
in the build pipeline.
Declare the repository as public with a main default branch and
delete-branch-after-merge enabled. Leave branch protection unset so the
initial fork seed can push the pinned upstream tree and a pristine upstream
ref directly to main; protection is added in a follow-up change once the fork
is seeded.
Why:
- The go-gitea/gitea provider's SDK (v0.25.1, already shipped in provider
0.8.1 on main) rejects a team permission of `none` on every EditTeam with
"permission mode invalid"; it only accepts read/write/admin/owner
client-side. The same check exists in the older 0.21.0 SDK, so the provider
version is not the lever here.
- The team module's `units` (server returns an unordered space-separated
string that never matches the provider's comma-ordered default) and
`repositories` (provider sorts state; `include_all_repositories` populates
every repo) drift on representation alone, so every apply plans an in-place
update for every team.
- Each update calls EditTeam, which replays the stored `permission=none` kept
by `ignore_changes` and fails, blocking apply for every non-owner team
(docker/terraform/rpmbuild/puppet/pybuild/forgebot/agents) and the whole
terraform-git apply, including the unkin-agent rollout.
Change:
- Add `units` and `repositories` to the team `ignore_changes` so provider
representation churn no longer triggers an EditTeam call.
- Preserve each team's current on-server permission and repository membership
(no access change).
Why:
- tofu apply fails with "Branch protection already exist" because the nine
repos protected in #60 already have live branch protection in Gitea that is
absent from Terraform state, so Terraform tries to create rules that already
exist and Gitea rejects them.
- The pinned go-gitea/gitea provider 0.7.0 defines no importer for
gitea_repository_branch_protection, so the existing rules cannot be adopted
on that version.
How:
- Bump the gitea provider from 0.7.0 to 0.8.1, which adds an importer for
gitea_repository_branch_protection (id format <org>/<repo>/<rule_name>).
- Add import blocks adopting the nine existing branch protections into state
instead of recreating them.
Why:
- An audit for the new unkin-agent bot (org-wide write) found repos with
no branch_protection at all, so the agent (or anyone with write) could
push straight to their default branch.
- The rest of the estate protects default branches; these repos were the gap.
How:
- Add enable_push: false + approval_whitelist_teams: Owners on each active
repo's default branch, matching the estate's most common convention
(PR-only; Owners can still open and approve).
- Omit status checks on these repos as none run CI, so a required context
would permanently block merges.
- Leave the 8 archived repos untouched: they are read-only, nothing can push
to them, and branch-protection creation on archived repos is rejected.
Why: AI coding agents currently push and open PRs as Ben's own account
using Ben's token, so their work is unattributable and carries Ben's full
owner privileges. A dedicated least-privilege identity separates agent work
from Ben's and keeps merge a human decision.
How:
- add the unkin-agent bot user (non-admin, no org/repo creation, limited
visibility); it authenticates via ephemeral vault-plugin-secrets-gitea
tokens, not a stored password
- add the agents team granting Write on all unkin repositories, the minimum
needed to push branches and open PRs; unkin-agent is its only member
- add merge_whitelist_teams Owners to every default-branch protection rule
that lacked a merge whitelist, so Write no longer implies merge and only
Owners (Ben) can merge across the estate
Scope grew beyond IPAM (devices, provisioning). Renaming the config file renames
the managed repo; the gitea provider archives the old terraform-ipam repo
(archive_on_destroy=true) and creates terraform-infra. terraform-ipam only holds an
auto-init README, so nothing is lost.
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
Provision the Gitea repo for a generic app-token Vault/OpenBao secrets
engine that issues short-lived signed JWTs for self-made services,
replacing per-app static bearer Secrets. Mirrors the existing plugin repo
entries (squash-only, main branch protection, PR CI checks).
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
Provision the repo for the new Kea DHCP Kubernetes operator that replaces
the ISC dhcpd PXE-boot VM.
- add config/git.unkin.net/unkin/repository/kea-operator.yaml
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
bootapi-images builds the AlmaLinux node rootfs tarballs that bootapi's
image-based provisioning (liveimg) unpacks, and on a v* tag publishes
almalinux9-node-<ver>.tar.zst to the artifactapi rootfs-images local repo. Split
out of bootapi-templates so that repo stays templates-only.
Modeled on the bootapi-templates entry: public, squash, delete-branch-after-merge,
main protection requiring the pre-commit + lint Woodpecker checks and benvin
approval.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
bootapi-templates holds the live kickstart/iPXE templates and the distro catalog
that bootapi pulls via git-sync (every ~3m, like argocd), so template/OS changes
ship without rebuilding bootapi. Its CI validates that every template parses and
renders for every catalog distro (via 'bootapi validate') plus shellcheck on the
%post snippets.
Modeled on the bootapi repo entry: public, squash, delete-branch-after-merge,
main protection requiring the pre-commit + validate Woodpecker checks and benvin
approval.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
bootapi is a Go service replacing Cobbler's PXE/kickstart side: it renders
kickstart files and iPXE boot scripts from NetBox data and serves them to
PXE-booting hosts. The ENC half already moved to encapi; bootapi covers the
provisioning/boot half.
Adds config/git.unkin.net/unkin/repository/bootapi.yaml modeled on encapi:
public repo, squash merges, delete-branch-after-merge, main branch protection
requiring the pre-commit/test/build Woodpecker checks and benvin approval.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Registers the logarchiver Gitea repo: a k8s Go service that archives
raw logs from NATS JetStream to S3 as zstd-compressed, GPG-encrypted,
indexed objects, plus a CLI to search and retrieve them. It replaces the
Vector archiver leg of the centralized logging stack (argocd-apps #296)
with zstd compression, OpenPGP encryption keyed from the Vault GPG
secrets engine, and a ClickHouse-backed searchable index.
- Add config/git.unkin.net/unkin/repository/logarchiver.yaml modeled on
the existing Go-service repos (encapi, cephrgw-operator): public repo,
main default branch, squash merges, branch protection requiring the
woodpecker pre-commit/test/build PR checks with benvin approval.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Why: the vault-plugin-secrets-gitea engine needs a purpose-built Gitea
site-admin credential to mint and delete per-user tokens. Provision that
account and its Vault seed here so the credential is generated once and never
exposed. Ben asked that the password be written to Vault exactly once and
never updated afterwards.
Change:
- Add config/git.unkin.net/user/gitea-vault-admin.yaml: a local site-admin bot
(admin: true, limited visibility, no org/repo creation).
- Extend the user module with an optional vault_seed_path/vault_seed_mount: when
set, write the account's generated password to Vault KV as admin_username and
admin_password via vault_kv_secret_v2, with lifecycle ignore_changes on
data_json so the write is create-only and never churns (random_password
already never regenerates). This keeps the seed stable and prevents a re-apply
from overwriting a password later rotated out-of-band by rotate-root.
- Add the hashicorp/vault provider (module plus root generate block); it reads
VAULT_ADDR and VAULT_TOKEN already exported by the Makefile k8s login.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Add a data-driven 'user' config kind so Gitea accounts are declared as
config/git.unkin.net/user/<name>.yaml, mirroring the existing repository
and team kinds. Wire the yaml into a new modules/user submodule that
creates a gitea_user (provider go-gitea/gitea 0.7.0, already pinned).
The provider's user resource requires a password; generate a per-user
random_password so nothing sensitive is hardcoded and only a placeholder
lives in state (tokens come later from vault-plugin-secrets-gitea).
Provision teabot's implementer and reviewer personality accounts with a
conservative posture: not site admins, no org creation, no repo creation,
limited profile visibility.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Create the Gitea repositories for the new vault-plugin-secrets-gitea
secrets engine and its companion terraform-provider-giteavaultsecret,
mirroring the rancher pair's settings.
- add config/git.unkin.net/unkin/repository/vault-plugin-secrets-gitea.yaml
- add config/git.unkin.net/unkin/repository/terraform-provider-giteavaultsecret.yaml
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
CI installed vault by shelling out to `dnf install vault -y`, which reads
metadata for every enabled repo (appstream/baseos/crb/epel/ha) and downloads
the 169MB vendored vault RPM from the unkin repo on every pipeline run
(~39s per plan/apply job).
- Replace the dnf install with a pinned curl of the upstream vault zip from
the artifactapi hashicorp-releases remote proxy, extracted with python3 to
/usr/local/bin/vault.
- Pin the version via a VAULT_VERSION env var (1.20.0).
terragrunt-enc will be the single source of truth for encapi ENC data
(statuses, roles, node classifications), managed via Terraform/Terragrunt,
superseding Cobbler classification for Puppet.
- Add config/git.unkin.net/unkin/repository/terragrunt-enc.yaml (public,
default_branch main, delete-branch-after-merge, squash merges).
- Protect main: block direct pushes, require the two Woodpecker PR status
checks (pre-commit, plan), and whitelist benvin for approvals.
The cephrgw-operator provisions Ceph RGW (S3) buckets and access keys from
Kubernetes CRDs via the Ceph manager dashboard API, and needs a Gitea repo
to host its code and run Woodpecker CI.
- Add config/git.unkin.net/unkin/repository/cephrgw-operator.yaml with the
standard public-repo settings (squash merge, delete branch on merge) and
main branch protection requiring the pre-commit/test/build PR checks.
Add branch protection to the openbao fork repository so main is protected: only
the owner may push directly and other changes must land via a pull request that
passes the fork build pipeline.
- Add branch_protection for main (whitelist-push to the owner; require the
ci/woodpecker/pr/build status check on PRs); set squash as the default merge
RFC2136 dynamic-DNS updater daemon (Go) that replaces the puppet dns-update
shell script. Squash merge, protected main with woodpecker build/test/pre-commit
status checks.
Create the Gitea repository for the private OpenBao fork so its integration
branch (main) can be pushed and hosted on git.unkin.net.
- Add config/git.unkin.net/unkin/repository/openbao.yaml (private, default branch
main, delete branch after merge)
The Terraform provider for the gpg secrets engine needs a Gitea repo to hold
its source and run its Woodpecker PR/release pipelines.
- Add config/git.unkin.net/unkin/repository/terraform-provider-gpgvaultsecret.yaml
(public, main default branch, squash-only, main branch protection gated on the
pre-commit/build/test PR checks), mirroring the sibling
terraform-provider-litellmvaultsecret repo.
passv (a Vault-backed drop-in for pass) needs a Gitea repo to hold its source
and run its Woodpecker PR/release pipelines.
- Add config/git.unkin.net/unkin/repository/passv.yaml (public, main default
branch, squash-only, main branch protection gated on the pre-commit/build/test
PR checks), mirroring the sibling vault-plugin-secrets-gpg repo.
Creates the two Gitea repositories backing the new Rancher token secrets engine:
a Vault/OpenBao plugin and its Terraform provider.
- Add config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml
(squash-only, main protected on pre-commit/build/test).
- Add config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml
(same protection profile as the litellm provider repo).
Provision the terraform-rancher Gitea repo, which will manage Rancher's
Authentik OIDC auth (keycloakoidc AuthConfig) via the rancher2 provider,
mirroring the terraform-authentik pattern.
The GPG/OpenPGP secrets engine needs a Gitea repo to hold its source and run
its Woodpecker PR/release pipelines.
- Add config/git.unkin.net/unkin/repository/vault-plugin-secrets-gpg.yaml
(public, main default branch, squash-only, main branch protection gated on
the pre-commit/build/test PR checks), mirroring the sibling
vault-plugin-secrets-bind-tsig repo.
Register a new public repo to host benvin-utils, a monorepo of small
single-purpose CLI tools (first tool: podgap) that share a common Go library.
- Add config/git.unkin.net/unkin/repository/benvin-utils.yaml (main default branch, delete branch after merge)
Declares the repo for a HashiCorp Vault / OpenBao secrets engine that
manages BIND TSIG keys via the bind-operator (static rotation + dynamic
creds). Mirrors the vault-plugin-secrets-litellm repo config.
Adds the Gitea repository that manages the Docker container build for the
jellyfin-ha (HA transcoding) Jellyfin fork.
- Create unkin/jellyfin-ha (public, squash merges, delete branch on merge)
- Protect main; require the ci/woodpecker/pr/build check and docker-team approval
Create the two Gitea repos backing the new Puppet ENC that replaces Cobbler:
- encapi: Go API + encapi-cli, Postgres-backed
- terraform-provider-encapi: Terraform provider for ENC roles/statuses/nodes
Both use main as default branch with squash-merge, delete-branch-after-merge,
and branch protection gated on the PR pipelines (pre-commit, test, build).
Merged PR branches should be cleaned up automatically everywhere, for a
consistent workflow across the estate.
- Flip default_delete_branch_after_merge from false to true on the 10 repos
that had it disabled.
- Add default_delete_branch_after_merge: true to the 3 repos that were missing
the field (terraform-git, terraform-provider-litellmvaultsecret,
vault-plugin-secrets-litellm).
node-lookup is being set up with build/test/pre-commit CI and a main-based
workflow, so its Gitea repo config needs to match.
- Change default_branch from master to main.
- Rename the branch protection rule to main and update the required status
checks to the new pipeline names (build, test, pre-commit) instead of the
old lint/unit-tests contexts.
Declares the bind-operator repo so Gitea provisions it for the new
Kubernetes operator that manages BIND9 DNS clusters.
- add config/git.unkin.net/unkin/repository/bind-operator.yaml with
main as default branch, squash merge, delete-branch-after-merge, and
branch protection requiring the pre-commit/test/build CI checks
Provision two new Gitea repos for the LiteLLM dynamic secrets work: the
Vault/OpenBao secrets-engine plugin and its companion Terraform provider.
- Add config/.../repository/vault-plugin-secrets-litellm.yaml
- Add config/.../repository/terraform-provider-litellm.yaml
- Default branch main, squash-only merging (allow_* flags, since the
go-gitea/gitea provider has no default_merge_style), and branch protection
on main requiring pre-commit/build/test checks with Owners approval
- Remove woodpecker_repository module and provider (repos managed outside TF)
- Add removed block with destroy=false to drop state without destroying
- Add module.team to branch_protection depends_on to prevent race condition
- Add lifecycle ignore_changes for team permission (provider bug: API returns
"none" but rejects it on write)
- Add forgebot team with unkinben and benvin members
- Enable branch protection on main for forgebot and forgebot-skills
- Team-based approval and merge whitelists
- Register both repos with Woodpecker CI
- CI status checks: pre-commit, test, build (forgebot); validate (skills)
- forgebot: branch protection on main with pre-commit, test, build CI checks
- forgebot-skills: branch protection on main with validate CI check
- Both repos enabled for Woodpecker CI
2026-06-12 00:32:57 +10:00
97 changed files with 1335 additions and 120 deletions
description:"Builds AlmaLinux node rootfs tarballs for bootapi image-based provisioning; on v* tag publishes almalinux9-node-<ver>.tar.zst to the artifactapi rootfs-images repo."
description:"Live kickstart/iPXE templates + distro catalog for bootapi. Pulled by bootapi via git-sync; CI validates templates render for every distro."
description:"RFC2136 dynamic-DNS updater daemon: watches a records file and network interfaces and pushes TSIG-signed updates to BIND, with a local status API for facter."
description:"Dependency-less Go CLI client for encapi, used as the Puppet exec External Node Classifier (ENC) on k8s compilers. Fetches the cobbler-wire ENC document and reshapes it for the puppet exec node_terminus."
description:"Archives raw logs from NATS JetStream to S3 as zstd-compressed, GPG-encrypted, indexed objects; plus a CLI to search and retrieve them. Go service + CLI."
description:"Merging HTTP proxy over two PuppetDB backends, presenting a single merged PuppetDB v4 query surface during the VM to k8s Puppet migration. Deployed in-cluster via argocd-apps."
description:"Single source of truth for encapi ENC data (statuses, roles, nodes), managed via Terraform/Terragrunt. Supersedes Cobbler node classification for Puppet."
description:"Fleet control plane for tomswall firewalls. Terraform-managed API that compiles fleet-wide zones, address groups, and firewall policy into per-device tomswall configs; agents pull and differentially apply."
description:"HashiCorp Vault / OpenBao secrets engine for Gitea: mints ephemeral, scoped per-user access tokens via the admin API, with seeded-admin basic-auth and root password rotation"
private:false
default_branch:"main"
default_delete_branch_after_merge:true
# Squash-only: the gitea provider has no "default merge style", so we restrict
description:"Monorepo of Go CLI tools for managing Vault tokens across multiple vault instances: vctl (login/renew per-context tokens) and vctx (context-aware wrapper around the vault CLI)."
# Gitea resolves whitelist names to IDs and returns them ordered by repo-reader (user ID for users, name for teams), dropping any entity without repo access, so the read-back representation never matches the config and plans a spurious update every run.
# Gitea's SDK rejects the stored permission=none on any EditTeam call; units/repositories only churn on provider representation (unordered units string, sorted/include-all repos), so ignore them to avoid spurious edits that would fail.
description="Map of Gitea user accounts to create"
type= map(object({
username=string
email=string
login_name=optional(string)
full_name=optional(string,"")
description=optional(string,"")
visibility=optional(string,"limited")
admin=optional(bool,false)
restricted=optional(bool,false)
active=optional(bool,true)
allow_create_organization=optional(bool,false)
max_repo_creation=optional(number,0)
must_change_password=optional(bool,false)
vault_seed_path=optional(string)
vault_seed_mount=optional(string,"kv")
}))
default={}
}
variable"team"{
description="Map of teams to create"
type= map(object({
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
unkinben
benvin
benvin