Merge branch 'main' into benvin/update1

feat: add terraform-git
- add new repo - change write -> none
2026-06-11 23:32:17 +10:00 · 2026-06-11 00:52:50 +10:00
97 changed files with 120 additions and 1328 deletions
@@ -7,10 +7,9 @@ steps:
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
-      VAULT_VERSION: "1.20.0"
    commands:
-      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
-      - make apply
+      - dnf install vault -y
+      - make apply-if-changes
    backend_options:
      kubernetes:
        serviceAccountName: terraform-git
@@ -6,9 +6,8 @@ steps:
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
-      VAULT_VERSION: "1.20.0"
    commands:
-      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
+      - dnf install vault -y
      - make plan
    backend_options:
      kubernetes:
@@ -33,14 +33,6 @@ locals {
      })
      if length(regexall("/team/", file_path)) > 0
    }
-    user = {
-      for file_path, content in local.all_configs :
-      "${split("/", file_path)[0]}/${trimsuffix(basename(file_path), ".yaml")}" => merge(content, {
-        username  = trimsuffix(basename(file_path), ".yaml")
-        gitea_url = split("/", file_path)[0]
-      })
-      if length(regexall("/user/", file_path)) > 0
-    }
    branch_protection = merge([
      for file_path, content in local.all_configs : {
        for idx, rule in try(content.branch_protection, []) :
@@ -1,16 +0,0 @@
-description: "Simple API for showing a users age"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "Owners"
-    merge_whitelist_teams:
-      - "Owners"
@@ -1,9 +1,4 @@
 description: "Sudaporn's Research Data visualisation, normalised "
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,9 +1,4 @@
 description: "Sudaporn's Research Data visualisation, normalised"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -4,12 +4,10 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
    enable_push: false
    status_check_contexts:
      - "ci/woodpecker/pr/pre-commit"
      - "ci/woodpecker/pr/kubeconform"
-      - "ci/woodpecker/pr/vector-test"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true
@@ -5,12 +5,11 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
  - rule_name: "master"
-    merge_whitelist_teams:
-      - "Owners"
    enable_push: false
    status_check_contexts:
      - "ci/woodpecker/pr/pre-commit"
      - "ci/woodpecker/pr/test"
      - "ci/woodpecker/pr/build"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true
@@ -1,9 +0,0 @@
-description: "Monorepo of small single-purpose CLI tools sharing a common library"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Kubernetes operator for managing BIND9 DNS clusters, zones, views, and TSIG keys"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,15 +0,0 @@
-description: "Builds AlmaLinux node rootfs tarballs for bootapi image-based provisioning; on v* tag publishes almalinux9-node-<ver>.tar.zst to the artifactapi rootfs-images repo."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/lint"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,15 +0,0 @@
-description: "Live kickstart/iPXE templates + distro catalog for bootapi. Pulled by bootapi via git-sync; CI validates templates render for every distro."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/validate"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,16 +0,0 @@
-description: "PXE/kickstart boot service replacing Cobbler. Renders kickstart + iPXE from NetBox data over HTTP. Go API."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,16 +0,0 @@
-description: "Kubernetes operator that provisions Ceph RGW (S3) buckets and access keys (RW/RO) from CRDs via the Ceph manager dashboard API"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,11 +1,12 @@
 description: "Vault PKI certificate issuance and SSH host key signing tool for Puppet-managed infrastructure"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 branch_protection:
  - rule_name: "master"
    enable_push: false
    merge_whitelist_users:
-      - "benvin"
+      - "unkinben"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true
@@ -1,15 +0,0 @@
-description: "Base container image for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
-      - "forgebot"
@@ -1,15 +0,0 @@
-description: "Dev toolchain container for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
-      - "forgebot"
@@ -1,15 +0,0 @@
-description: "Infrastructure toolchain container for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
-      - "forgebot"
@@ -1,8 +1,3 @@
 description: "Docker image to be used in Kubernetes as a developers container"
 private: false
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,16 +0,0 @@
-description: "RFC2136 dynamic-DNS updater daemon: watches a records file and network interfaces and pushes TSIG-signed updates to BIND, with a local status API for facter."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -3,8 +3,3 @@ private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
 repo_template: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Postgres-backed External Node Classifier (ENC) for Puppet, replacing Cobbler. Go API + encapi-cli."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,16 +0,0 @@
-description: "Dependency-less Go CLI client for encapi, used as the Puppet exec External Node Classifier (ENC) on k8s compilers. Fetches the cobbler-wire ENC document and reshapes it for the puppet exec node_terminus."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,14 +0,0 @@
-description: "Skill definitions for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/validate"
-    approval_whitelist_teams:
-      - "forgebot"
-    merge_whitelist_teams:
-      - "forgebot"
@@ -1,16 +0,0 @@
-description: "K8s operator + API for AI agent dispatch from git forges"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "forgebot"
-    merge_whitelist_teams:
-      - "forgebot"
@@ -1,8 +1,3 @@
 description: "A repository for building initrd.img in docker "
 private: false
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,9 +0,0 @@
-description: "Source fork of ZoltyMat/jellyfin-ha carrying HA patches"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,14 +0,0 @@
-description: "Container build for the jellyfin-ha (HA transcoding) Jellyfin fork"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
@@ -1,16 +0,0 @@
-description: "Kubernetes operator for managing Kea DHCP clusters, subnets, and PXE client classes"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Archives raw logs from NATS JetStream to S3 as zstd-compressed, GPG-encrypted, indexed objects; plus a CLI to search and retrieve them. Go service + CLI."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,16 +1,15 @@
 description: "A CLI tool written in Go that queries the PuppetDB API to look up and filter node facts."
 private: false
-default_branch: "main"
+default_branch: "master"
 default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
+  - rule_name: "master"
    enable_push: false
    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/lint"
      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/unit-tests"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true
@@ -1,17 +0,0 @@
-description: "Private fork of OpenBao adding per-namespace raft, cross-cluster performance replicas, virtual KV, and KV events"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Whitelist-push: the owner can push main directly (needed for the initial
-    # push and the fork's maintenance workflow); everyone else must open a PR.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    # PRs to main must pass the fork build/vet pipeline before merge.
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
@@ -1,21 +0,0 @@
-description: "Vault-backed drop-in replacement for pass (password-store); routes GPG crypto through vault-plugin-secrets-gpg"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Merging HTTP proxy over two PuppetDB backends, presenting a single merged PuppetDB v4 query surface during the VM to k8s Puppet migration. Deployed in-cluster via argocd-apps."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -35,3 +35,4 @@ branch_protection:
      - "ci/woodpecker/pr/yamllint"
    approval_whitelist_teams:
      - "puppet"
+woodpecker: true
@@ -13,3 +13,4 @@ branch_protection:
    approval_whitelist_teams:
      - "puppet"
    block_on_rejected_reviews: true
+woodpecker: true
@@ -2,8 +2,3 @@ description: "A fastapi service to present puppet services via an api"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,9 +1,4 @@
 description: "Package the internal ca-certificates"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,5 +1,5 @@
 description: "Build rpms for jellyfin-web"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 archived: true
@@ -18,3 +18,4 @@ branch_protection:
    approval_whitelist_teams:
      - "rpmbuild"
    block_on_rejected_reviews: true
+woodpecker: true
@@ -1,8 +1,3 @@
 description: "A stack of microservices that aim to offer a distributed streaming service."
 private: false
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,16 +0,0 @@
-description: "A Go daemon that watches Gitea repos and dispatches one-shot Claude Code sessions in Docker to work issues and review PRs."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing ArtifactAPI remote and virtual repositories"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Authentik identity provider"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +1,14 @@
 description: "Manage Gitea resources, teams, repos, and Woodpecker CI via Terraform"
 private: false
 default_branch: "main"
-default_delete_branch_after_merge: true
+woodpecker: true
 branch_protection:
  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
    enable_push: false
    status_check_contexts:
      - "ci/woodpecker/pr/pre-commit"
      - "ci/woodpecker/pr/plan"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
    approval_whitelist_teams:
      - "Owners"
@@ -1,16 +0,0 @@
-description: "YAML-driven Terraform for NetBox IPAM, networks, and devices + Kea DHCP"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,7 +1,7 @@
 description: "Manage nomad with Terraform"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 branch_protection:
  - rule_name: "master"
    enable_push: false
@@ -1,14 +1,9 @@
 description: "Terraform provider for managing ArtifactAPI"
 private: false
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 branch_protection:
  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
    approval_whitelist_teams:
      - "Owners"
+woodpecker: true
@@ -1,16 +0,0 @@
-description: "Terraform provider for encapi: manage Puppet ENC roles, statuses, and node assignments."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao Gitea token secrets engine (giteavaultsecret)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao GPG/OpenPGP secrets engine (gpgvaultsecret) — manage backends and keys"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Terraform provider for the kea-operator KeaAPI: manage Kea DHCP subnets and PXE client classes."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao LiteLLM dynamic secrets engine (litellmvaultsecret)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao Rancher token secrets engine (ranchervaultsecret)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Terraform provider for tomswallapi: manage fleet-global firewall policy (zones, address groups, portgroups, rules, policies, fabrics) and per-device bindings."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao NetBox token secrets engine (pairs with vault-plugin-secrets-netbox)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Prowlarr indexer automation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Radarr movie automation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Rancher (auth, roles) via the rancher2 provider"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Sonarr TV automation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -13,6 +13,7 @@ branch_protection:
      - "ci/woodpecker/pr/pre-commit"
      - "ci/woodpecker/pr/plan"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
    approval_whitelist_teams:
      - "Owners"
+woodpecker: true
@@ -1,15 +0,0 @@
-description: "Single source of truth for encapi ENC data (statuses, roles, nodes), managed via Terraform/Terragrunt. Supersedes Cobbler node classification for Puppet."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,10 +0,0 @@
-description: "Spiritual successor to shorewall — nftables firewall manager using google/nftables"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
@@ -1,16 +0,0 @@
-description: "Fleet control plane for tomswall firewalls. Terraform-managed API that compiles fleet-wide zones, address groups, and firewall policy into per-device tomswall configs; agents pull and differentially apply."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine issuing short-lived signed JWT app tokens (per-app roles, offline JWKS validation) for self-made services"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for BIND TSIG keys (static rotation + dynamic creds via bind-operator)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for Gitea: mints ephemeral, scoped per-user access tokens via the admin API, with seeded-admin basic-auth and root password rotation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for GPG/OpenPGP keys (sign/verify/encrypt/decrypt, transit-style versioned keys, pass-compatible)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao dynamic secrets engine for LiteLLM virtual keys"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for NetBox API tokens (seeded admin + dynamic per-user tokens with expiry-aligned leases)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for Rancher API tokens (seeded root rotation + dynamic scoped creds via tokens.ext.cattle.io)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Monorepo of Go CLI tools for managing Vault tokens across multiple vault instances: vctl (login/renew per-context tokens) and vctx (context-aware wrapper around the vault CLI)."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,14 +0,0 @@
-# Grants the unkin-agent bot Write across every unkin repository so Ben's AI
-# coding agents can push benvin/* branches and open pull requests. Write is the
-# minimum Gitea permission that allows pushing branches + creating PRs.
-#
-# Merge stays reserved for Ben: branch protection on every default branch sets a
-# merge whitelist of the Owners team only, so members of this team can push and
-# open PRs but cannot merge or approve. Keep this team out of every merge and
-# approval whitelist.
-description: "AI coding agents -- push branches + open PRs, never merge"
-permission: write
-include_all_repositories: true
-can_create_repos: false
-members:
-  - unkin-agent
@@ -1,13 +0,0 @@
-description: "forgebot maintainers"
-permission: none
-include_all_repositories: false
-can_create_repos: false
-repositories:
-  - forgebot
-  - forgebot-skills
-  - container-agent-base
-  - container-agent-dev
-  - container-agent-infra
-members:
-  - unkinben
-  - benvin
@@ -1,21 +0,0 @@
-# Purpose-built Gitea site-admin bot for the vault-plugin-secrets-gitea engine.
-# The engine seeds itself from this account's credentials (Basic Auth) to mint
-# and delete per-user tokens for any user. Its randomly generated password is
-# written ONCE to Vault KV (vault_seed_path below) and never updated after; the
-# Vault gitea engine reads that seed only when first creating gitea/config and
-# then rotates it (rotate-root) so only Vault holds the live password.
-#
-# A local (not external-auth) account with 2FA disabled is required so the
-# engine can change the password via the admin API during rotate-root.
-email: gitea-vault-admin@unkin.net
-full_name: "Gitea Vault Admin"
-description: "site-admin bot; credentials seeded to Vault for vault-plugin-secrets-gitea"
-# Site admin so the engine may mint/delete tokens for any user. No org/repo
-# creation; profile visible only to signed-in users.
-visibility: limited
-admin: true
-allow_create_organization: false
-max_repo_creation: 0
-# Seed this account's generated password to Vault KV (mount "kv") at this path,
-# where the Vault gitea secrets engine reads it at creation time. Written once.
-vault_seed_path: "service/vault/au/syd1/secret_backend/gitea/config"
@@ -1,14 +0,0 @@
-# teabot "implementer" personality account.
-# Used by the teabot daemon (unkin/teabot) to open issues/PRs as a distinct
-# identity so its work is attributable. Auth is via an API token issued
-# out-of-band (vault-plugin-secrets-gitea / static KV) -- no token or usable
-# password lives in this repo's state beyond the generated placeholder.
-email: teabot-implementer@unkin.net
-full_name: "Teabot Implementer"
-description: "teabot implementer bot -- automated agent (unkin/teabot)"
-# Conservative bot posture: not a site admin, cannot create orgs or repos,
-# profile visible only to signed-in users.
-visibility: limited
-admin: false
-allow_create_organization: false
-max_repo_creation: 0
@@ -1,14 +0,0 @@
-# teabot "reviewer" personality account.
-# Used by the teabot daemon (unkin/teabot) to review pull requests as a distinct
-# identity so its reviews are attributable. Auth is via an API token issued
-# out-of-band (vault-plugin-secrets-gitea / static KV) -- no token or usable
-# password lives in this repo's state beyond the generated placeholder.
-email: teabot-reviewer@unkin.net
-full_name: "Teabot Reviewer"
-description: "teabot reviewer bot -- automated agent (unkin/teabot)"
-# Conservative bot posture: not a site admin, cannot create orgs or repos,
-# profile visible only to signed-in users.
-visibility: limited
-admin: false
-allow_create_organization: false
-max_repo_creation: 0
@@ -1,18 +0,0 @@
-# Shared identity used by Ben's AI coding agents to submit work (branches, pull
-# requests, issues, comments) as a distinct, attributable, least-privilege
-# account instead of Ben's own login. Auth is via ephemeral API tokens minted by
-# the vault-plugin-secrets-gitea engine (gitea/creds/unkin-agent) -- no token or
-# usable password lives in this repo's state beyond the generated placeholder.
-#
-# Write access comes from the "agents" team (team/agents.yaml); merge is blocked
-# by branch protection (merge whitelist = Owners only), so the agent can open and
-# comment on PRs/issues but never merge or approve.
-email: unkin-agent@unkin.net
-full_name: "Unkin Agent"
-description: "shared identity for automated AI coding agents -- write, never merge"
-# Conservative bot posture: not a site admin, cannot create orgs or repos,
-# profile visible only to signed-in users.
-visibility: limited
-admin: false
-allow_create_organization: false
-max_repo_creation: 0
@@ -21,5 +21,4 @@ inputs = {
  repository        = local.config.repository
  branch_protection = local.config.branch_protection
  team              = local.config.team
-  user              = local.config.user
 }
@@ -11,15 +11,6 @@ provider "woodpecker" {
  server = "https://ci.k8s.syd1.au.unkin.net"
 }

-# Address + token come from VAULT_ADDR / VAULT_TOKEN in the environment (the
-# Makefile authenticates via k8s auth before running terragrunt). Used to seed
-# bot-account credentials into Vault KV (see modules/user vault_seed_path).
-# skip_child_token: the CI token from the k8s auth role cannot create child
-# tokens (apply fails with "failed to create limited child token").
-provider "vault" {
-  skip_child_token = true
-}
-
 terraform {
  backend "consul" {
    address = "https://consul.service.consul"
@@ -143,31 +143,6 @@ import {
  id = "137"
 }

-import {
-  to = module.repository["git.unkin.net/unkin/forgebot"].gitea_repository.this
-  id = "139"
-}
-
-import {
-  to = module.repository["git.unkin.net/unkin/forgebot-skills"].gitea_repository.this
-  id = "140"
-}
-
-import {
-  to = module.repository["git.unkin.net/unkin/container-agent-base"].gitea_repository.this
-  id = "141"
-}
-
-import {
-  to = module.repository["git.unkin.net/unkin/container-agent-dev"].gitea_repository.this
-  id = "142"
-}
-
-import {
-  to = module.repository["git.unkin.net/unkin/container-agent-infra"].gitea_repository.this
-  id = "143"
-}
-
 import {
  to = module.team["git.unkin.net/unkin/Owners"].gitea_team.this
  id = "3"
@@ -198,55 +173,58 @@ import {
  id = "12"
 }

+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/puppet-prod"].woodpecker_repository.this
+  id = "unkin/puppet-prod"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/puppet-r10k"].woodpecker_repository.this
+  id = "unkin/puppet-r10k"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-vault"].woodpecker_repository.this
+  id = "unkin/terraform-vault"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/rpmbuilder"].woodpecker_repository.this
+  id = "unkin/rpmbuilder"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/artifactapi"].woodpecker_repository.this
+  id = "unkin/artifactapi"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/argocd-apps"].woodpecker_repository.this
+  id = "unkin/argocd-apps"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/certmanager"].woodpecker_repository.this
+  id = "unkin/certmanager"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/node-lookup"].woodpecker_repository.this
+  id = "unkin/node-lookup"
+}
+
+import {
+  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-provider-artifactapi"].woodpecker_repository.this
+  id = "unkin/terraform-provider-artifactapi"
+}
+
 import {
  to = module.repository["git.unkin.net/unkin/terraform-git"].gitea_repository.this
  id = "144"
 }

-# Branch protections that already exist in Gitea but are not yet in state.
-# Import id format is <organisation>/<repository>/<rule_name>.
 import {
-  to = module.branch_protection["git.unkin.net/unkin/app-sudaporn-research-individual/master"].gitea_repository_branch_protection.this
-  id = "unkin/app-sudaporn-research-individual/master"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/app-sudaporn-research-normalised/master"].gitea_repository_branch_protection.this
-  id = "unkin/app-sudaporn-research-normalised/master"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/benvin-utils/main"].gitea_repository_branch_protection.this
-  id = "unkin/benvin-utils/main"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/container-devcompute/main"].gitea_repository_branch_protection.this
-  id = "unkin/container-devcompute/main"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/docker-template/master"].gitea_repository_branch_protection.this
-  id = "unkin/docker-template/master"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/initbuilder/main"].gitea_repository_branch_protection.this
-  id = "unkin/initbuilder/main"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/puppetapi/master"].gitea_repository_branch_protection.this
-  id = "unkin/puppetapi/master"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/rpmbuild-internal-ca-certificates/master"].gitea_repository_branch_protection.this
-  id = "unkin/rpmbuild-internal-ca-certificates/master"
-}
-
-import {
-  to = module.branch_protection["git.unkin.net/unkin/streamstack/main"].gitea_repository_branch_protection.this
-  id = "unkin/streamstack/main"
+  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-git"].woodpecker_repository.this
+  id = "unkin/terraform-git"
 }

@@ -38,27 +38,6 @@ module "repository" {
  depends_on = [module.organisation]
 }

-module "user" {
-  source = "./modules/user"
-
-  for_each = var.user
-
-  username                  = each.value.username
-  email                     = each.value.email
-  login_name                = each.value.login_name
-  full_name                 = each.value.full_name
-  description               = each.value.description
-  visibility                = each.value.visibility
-  admin                     = each.value.admin
-  restricted                = each.value.restricted
-  active                    = each.value.active
-  allow_create_organization = each.value.allow_create_organization
-  max_repo_creation         = each.value.max_repo_creation
-  must_change_password      = each.value.must_change_password
-  vault_seed_path           = each.value.vault_seed_path
-  vault_seed_mount          = each.value.vault_seed_mount
-}
-
 module "team" {
  source = "./modules/team"

@@ -76,12 +55,18 @@ module "team" {
  depends_on = [module.organisation, module.repository]
 }

-removed {
-  from = module.woodpecker_repository
+module "woodpecker_repository" {
+  source = "./modules/woodpecker_repository"

-  lifecycle {
-    destroy = false
+  for_each = {
+    for k, v in var.repository : k => v
+    if try(v.woodpecker, false)
  }
+
+  full_name  = "${each.value.organisation}/${each.value.name}"
+  visibility = each.value.private ? "private" : "public"
+
+  depends_on = [module.repository]
 }

 module "branch_protection" {
@@ -110,7 +95,7 @@ module "branch_protection" {
  protected_file_patterns           = each.value.protected_file_patterns
  unprotected_file_patterns         = each.value.unprotected_file_patterns

-  depends_on = [module.repository, module.team]
+  depends_on = [module.repository]
 }

 # TODO: enable when deploy keys are needed
@@ -3,7 +3,7 @@ terraform {
  required_providers {
    gitea = {
      source  = "go-gitea/gitea"
-      version = "0.8.1"
+      version = "0.7.0"
    }
  }
 }
@@ -3,7 +3,7 @@ terraform {
  required_providers {
    gitea = {
      source  = "go-gitea/gitea"
-      version = "0.8.1"
+      version = "0.7.0"
    }
  }
 }
@@ -3,7 +3,7 @@ terraform {
  required_providers {
    gitea = {
      source  = "go-gitea/gitea"
-      version = "0.8.1"
+      version = "0.7.0"
    }
  }
 }
@@ -17,9 +17,4 @@ resource "gitea_repository" "this" {
  website                 = var.website
  autodetect_manual_merge = var.autodetect_manual_merge
  archive_on_destroy      = true
-
-  lifecycle {
-    # migration_mirror_interval defaults to "8h0m0s" but Gitea returns an empty MirrorInterval for non-mirror repos, so the read-back never matches and plans a spurious update every run; it is a migration-only knob with no drift to track here.
-    ignore_changes = [migration_mirror_interval]
-  }
 }
@@ -3,7 +3,7 @@ terraform {
  required_providers {
    gitea = {
      source  = "go-gitea/gitea"
-      version = "0.8.1"
+      version = "0.7.0"
    }
  }
 }
@@ -6,11 +6,6 @@ resource "gitea_team" "this" {
  include_all_repositories = var.include_all_repositories
  can_create_repos         = var.can_create_repos
  repositories             = var.repositories
-
-  lifecycle {
-    # Gitea's SDK rejects the stored permission=none on any EditTeam call; units/repositories only churn on provider representation (unordered units string, sorted/include-all repos), so ignore them to avoid spurious edits that would fail.
-    ignore_changes = [permission, units, repositories]
-  }
 }

 resource "gitea_team_members" "this" {
@@ -3,7 +3,7 @@ terraform {
  required_providers {
    gitea = {
      source  = "go-gitea/gitea"
-      version = "0.8.1"
+      version = "0.7.0"
    }
  }
 }
@@ -1,58 +0,0 @@
-# The gitea_user resource requires a password argument. These accounts
-# authenticate via API tokens (issued out-of-band by the
-# vault-plugin-secrets-gitea engine, or a static KV entry initially), so the
-# password is never used interactively. It is generated here so nothing
-# sensitive is hardcoded, and kept only in state.
-resource "random_password" "this" {
-  length           = 32
-  special          = true
-  override_special = "!@#%^&*()-_=+"
-}
-
-resource "gitea_user" "this" {
-  username   = var.username
-  login_name = coalesce(var.login_name, var.username)
-  email      = var.email
-  password   = random_password.this.result
-
-  full_name   = var.full_name
-  description = var.description
-  visibility  = var.visibility
-
-  admin                     = var.admin
-  restricted                = var.restricted
-  active                    = var.active
-  allow_create_organization = var.allow_create_organization
-  max_repo_creation         = var.max_repo_creation
-  must_change_password      = var.must_change_password
-
-  # Do not e-mail the (possibly unmonitored) bot address on creation.
-  send_notification = false
-
-  lifecycle {
-    # The provider cannot read the password back from the API; ignore it so the
-    # account never shows perpetual drift once created.
-    ignore_changes = [password]
-  }
-}
-
-# Optional one-time seed of the account's credentials to Vault KV, for the
-# vault-plugin-secrets-gitea engine to consume when it first creates gitea/config.
-# random_password never regenerates (no keepers), so the seed is stable; the
-# ignore_changes below makes the write strictly create-only, so a later
-# rotate-root on the Vault side (which diverges the live password from this seed)
-# is never clobbered by a re-apply here.
-resource "vault_kv_secret_v2" "seed" {
-  count = var.vault_seed_path != null ? 1 : 0
-
-  mount = var.vault_seed_mount
-  name  = var.vault_seed_path
-  data_json = jsonencode({
-    admin_username = var.username
-    admin_password = random_password.this.result
-  })
-
-  lifecycle {
-    ignore_changes = [data_json]
-  }
-}
@@ -1,17 +0,0 @@
-terraform {
-  required_version = ">= 1.10"
-  required_providers {
-    gitea = {
-      source  = "go-gitea/gitea"
-      version = "0.8.1"
-    }
-    random = {
-      source  = "hashicorp/random"
-      version = ">= 3.5"
-    }
-    vault = {
-      source  = "hashicorp/vault"
-      version = ">= 4.3"
-    }
-  }
-}
@@ -1,87 +0,0 @@
-variable "username" {
-  description = "Username of the Gitea account (immutable; changing it recreates the user)"
-  type        = string
-}
-
-variable "login_name" {
-  description = "Login name, may differ from username. Defaults to the username."
-  type        = string
-  default     = null
-}
-
-variable "email" {
-  description = "E-Mail address of the user"
-  type        = string
-}
-
-variable "full_name" {
-  description = "Display / full name of the user"
-  type        = string
-  default     = ""
-}
-
-variable "description" {
-  description = "Profile description of the user"
-  type        = string
-  default     = ""
-}
-
-variable "visibility" {
-  description = "Profile visibility: public, limited or private"
-  type        = string
-  default     = "limited"
-}
-
-variable "admin" {
-  description = "Whether the user is a site administrator"
-  type        = bool
-  default     = false
-}
-
-variable "restricted" {
-  description = "Restricted users can only access repositories/orgs they are explicitly added to"
-  type        = bool
-  default     = false
-}
-
-variable "active" {
-  description = "Whether the account is active"
-  type        = bool
-  default     = true
-}
-
-variable "allow_create_organization" {
-  description = "Whether the user may create organisations"
-  type        = bool
-  default     = false
-}
-
-variable "max_repo_creation" {
-  description = "Maximum number of repositories the user may create (0 disallows creation)"
-  type        = number
-  default     = 0
-}
-
-variable "must_change_password" {
-  description = "Force a password change on first login"
-  type        = bool
-  default     = false
-}
-
-variable "vault_seed_path" {
-  description = <<-EOT
-    Optional. When set, the account's generated password is seeded ONCE to Vault
-    KV at this secret name (under vault_seed_mount) as admin_username +
-    admin_password, for the vault-plugin-secrets-gitea engine to consume at
-    creation time. The write is create-only; subsequent changes are ignored so
-    the seed never churns (and never overwrites a rotated password).
-  EOT
-  type        = string
-  default     = null
-}
-
-variable "vault_seed_mount" {
-  description = "KV v2 mount holding the seeded credential (used only when vault_seed_path is set)"
-  type        = string
-  default     = "kv"
-}
@@ -0,0 +1,4 @@
+resource "woodpecker_repository" "this" {
+  full_name  = var.full_name
+  visibility = var.visibility
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    woodpecker = {
+      source  = "Kichiyaki/woodpecker"
+      version = "0.5.0"
+    }
+  }
+}
@@ -0,0 +1,8 @@
+variable "full_name" {
+  type = string
+}
+
+variable "visibility" {
+  type    = string
+  default = "internal"
+}
@@ -3,19 +3,11 @@ terraform {
  required_providers {
    gitea = {
      source  = "go-gitea/gitea"
-      version = "0.8.1"
+      version = "0.7.0"
    }
    woodpecker = {
      source  = "Kichiyaki/woodpecker"
      version = "0.5.0"
    }
-    random = {
-      source  = "hashicorp/random"
-      version = ">= 3.5"
-    }
-    vault = {
-      source  = "hashicorp/vault"
-      version = ">= 4.3"
-    }
  }
 }
@@ -32,6 +32,7 @@ variable "repository" {
    repo_template           = optional(bool)
    website                 = optional(string)
    autodetect_manual_merge = optional(bool)
+    woodpecker              = optional(bool, false)
  }))
  default = {}
 }
@@ -64,27 +65,6 @@ variable "branch_protection" {
 }


-variable "user" {
-  description = "Map of Gitea user accounts to create"
-  type = map(object({
-    username                  = string
-    email                     = string
-    login_name                = optional(string)
-    full_name                 = optional(string, "")
-    description               = optional(string, "")
-    visibility                = optional(string, "limited")
-    admin                     = optional(bool, false)
-    restricted                = optional(bool, false)
-    active                    = optional(bool, true)
-    allow_create_organization = optional(bool, false)
-    max_repo_creation         = optional(number, 0)
-    must_change_password      = optional(bool, false)
-    vault_seed_path           = optional(string)
-    vault_seed_mount          = optional(string, "kv")
-  }))
-  default = {}
-}
-
 variable "team" {
  description = "Map of teams to create"
  type = map(object({
Author	SHA1	Message	Date
benvin	5c784eff19	Merge branch 'main' into benvin/update1 ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details	2026-06-11 23:32:17 +10:00
unkinben	cee451f741	feat: add terraform-git ci/woodpecker/pr/pre-commit Pipeline failed Details ci/woodpecker/pr/plan Pipeline was successful Details - add new repo - change write -> none	2026-06-11 00:52:50 +10:00