CI installed vault by shelling out to `dnf install vault -y`, which reads
metadata for every enabled repo (appstream/baseos/crb/epel/ha) and downloads
the 169MB vendored vault RPM from the unkin repo on every pipeline run
(~39s per plan/apply job).
- Replace the dnf install with a pinned curl of the upstream vault zip from
the artifactapi hashicorp-releases remote proxy, extracted with python3 to
/usr/local/bin/vault.
- Pin the version via a VAULT_VERSION env var (1.20.0).
terragrunt-enc will be the single source of truth for encapi ENC data
(statuses, roles, node classifications), managed via Terraform/Terragrunt,
superseding Cobbler classification for Puppet.
- Add config/git.unkin.net/unkin/repository/terragrunt-enc.yaml (public,
default_branch main, delete-branch-after-merge, squash merges).
- Protect main: block direct pushes, require the two Woodpecker PR status
checks (pre-commit, plan), and whitelist benvin for approvals.
The cephrgw-operator provisions Ceph RGW (S3) buckets and access keys from
Kubernetes CRDs via the Ceph manager dashboard API, and needs a Gitea repo
to host its code and run Woodpecker CI.
- Add config/git.unkin.net/unkin/repository/cephrgw-operator.yaml with the
standard public-repo settings (squash merge, delete branch on merge) and
main branch protection requiring the pre-commit/test/build PR checks.
Add branch protection to the openbao fork repository so main is protected: only
the owner may push directly and other changes must land via a pull request that
passes the fork build pipeline.
- Add branch_protection for main (whitelist-push to the owner; require the
ci/woodpecker/pr/build status check on PRs); set squash as the default merge
RFC2136 dynamic-DNS updater daemon (Go) that replaces the puppet dns-update
shell script. Squash merge, protected main with woodpecker build/test/pre-commit
status checks.
Create the Gitea repository for the private OpenBao fork so its integration
branch (main) can be pushed and hosted on git.unkin.net.
- Add config/git.unkin.net/unkin/repository/openbao.yaml (private, default branch
main, delete branch after merge)
The Terraform provider for the gpg secrets engine needs a Gitea repo to hold
its source and run its Woodpecker PR/release pipelines.
- Add config/git.unkin.net/unkin/repository/terraform-provider-gpgvaultsecret.yaml
(public, main default branch, squash-only, main branch protection gated on the
pre-commit/build/test PR checks), mirroring the sibling
terraform-provider-litellmvaultsecret repo.
passv (a Vault-backed drop-in for pass) needs a Gitea repo to hold its source
and run its Woodpecker PR/release pipelines.
- Add config/git.unkin.net/unkin/repository/passv.yaml (public, main default
branch, squash-only, main branch protection gated on the pre-commit/build/test
PR checks), mirroring the sibling vault-plugin-secrets-gpg repo.
Creates the two Gitea repositories backing the new Rancher token secrets engine:
a Vault/OpenBao plugin and its Terraform provider.
- Add config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml
(squash-only, main protected on pre-commit/build/test).
- Add config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml
(same protection profile as the litellm provider repo).
Provision the terraform-rancher Gitea repo, which will manage Rancher's
Authentik OIDC auth (keycloakoidc AuthConfig) via the rancher2 provider,
mirroring the terraform-authentik pattern.
2026-07-15 21:17:47 +10:00
16 changed files with 224 additions and 2 deletions
description:"RFC2136 dynamic-DNS updater daemon: watches a records file and network interfaces and pushes TSIG-signed updates to BIND, with a local status API for facter."
description:"Dependency-less Go CLI client for encapi, used as the Puppet exec External Node Classifier (ENC) on k8s compilers. Fetches the cobbler-wire ENC document and reshapes it for the puppet exec node_terminus."
description:"Merging HTTP proxy over two PuppetDB backends, presenting a single merged PuppetDB v4 query surface during the VM to k8s Puppet migration. Deployed in-cluster via argocd-apps."
description:"Single source of truth for encapi ENC data (statuses, roles, nodes), managed via Terraform/Terragrunt. Supersedes Cobbler node classification for Puppet."
description:"Fleet control plane for tomswall firewalls. Terraform-managed API that compiles fleet-wide zones, address groups, and firewall policy into per-device tomswall configs; agents pull and differentially apply."
description:"HashiCorp Vault / OpenBao secrets engine for Rancher API tokens (seeded root rotation + dynamic scoped creds via tokens.ext.cattle.io)"
private:false
default_branch:"main"
default_delete_branch_after_merge:true
# Squash-only: the gitea provider has no "default merge style", so we restrict
# the allowed styles to squash to force it.
allow_merge_commits:false
allow_rebase:false
allow_rebase_explicit:false
allow_squash_merge:true
branch_protection:
- rule_name:"main"
enable_push:false
status_check_contexts:
- "ci/woodpecker/pr/pre-commit"
- "ci/woodpecker/pr/build"
- "ci/woodpecker/pr/test"
approval_whitelist_teams:
- "Owners"
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
unkinben
benvin
benvin