Merge pull request 'Add vault-plugin-secrets-litellm and terraform-provider-litellm repos' (#18) from benvin/add-litellm-repos into main

Reviewed-on: #18

.woodpecker/apply.yaml

@@ -9,7 +9,6 @@ steps:
       VAULT_AUTH_METHOD: kubernetes
     commands:
       - dnf install vault -y
-      - make plan
       - make apply
     backend_options:
       kubernetes:

Makefile

@@ -1,4 +1,4 @@
-.PHONY: init plan apply format
+.PHONY: init plan apply apply-if-changes format pre-commit
 
 VAULT_AUTH_METHOD ?= approle
 VAULT_K8S_ROLE ?= woodpecker_terraform_git
@@ -25,6 +25,19 @@ plan: init
 	@$(call vault_env) && \
 	terragrunt run --all --parallelism 4 --non-interactive plan
 
+apply-if-changes: init
+	@$(call vault_env) && \
+	terragrunt run --all --parallelism 4 --non-interactive plan -- -detailed-exitcode -out=tfplan; \
+	EXIT_CODE=$$?; \
+	if [ $$EXIT_CODE -eq 2 ]; then \
+		$(call vault_env) && \
+		terragrunt run --all --parallelism 2 --non-interactive apply -- tfplan; \
+	elif [ $$EXIT_CODE -eq 0 ]; then \
+		echo "No changes detected, skipping apply."; \
+	else \
+		exit $$EXIT_CODE; \
+	fi
+
 apply: init
 	@$(call vault_env) && \
 	terragrunt run --all --parallelism 2 --non-interactive apply
@@ -34,3 +47,6 @@ format:
 	@tofu fmt -recursive .
 	@echo "Formatting Terragrunt files..."
 	@terragrunt hcl fmt
+
+pre-commit:
+	@uvx pre-commit run --all-files

config/git.unkin.net/unkin/repository/age-api.yaml

@@ -0,0 +1,16 @@
+description: "Simple API for showing a users age"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "Owners"
+    merge_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/argocd-apps.yaml

@@ -10,4 +10,3 @@ branch_protection:
       - "ci/woodpecker/pr/kubeconform"
     approval_whitelist_users:
       - "unkinben"
-woodpecker: true

config/git.unkin.net/unkin/repository/artifactapi.yaml

@@ -12,4 +12,3 @@ branch_protection:
       - "ci/woodpecker/pr/build"
     approval_whitelist_users:
       - "unkinben"
-woodpecker: true

config/git.unkin.net/unkin/repository/certmanager.yaml

@@ -9,4 +9,3 @@ branch_protection:
       - "unkinben"
     approval_whitelist_users:
       - "unkinben"
-woodpecker: true

config/git.unkin.net/unkin/repository/container-agent-base.yaml

@@ -0,0 +1,13 @@
+description: "Base container image for forgebot agents"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "docker"
+      - "forgebot"

config/git.unkin.net/unkin/repository/container-agent-dev.yaml

@@ -0,0 +1,13 @@
+description: "Dev toolchain container for forgebot agents"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "docker"
+      - "forgebot"

config/git.unkin.net/unkin/repository/container-agent-infra.yaml

@@ -0,0 +1,13 @@
+description: "Infrastructure toolchain container for forgebot agents"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "docker"
+      - "forgebot"

config/git.unkin.net/unkin/repository/forgebot-skills.yaml

@@ -0,0 +1,14 @@
+description: "Skill definitions for forgebot agents"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/validate"
+    approval_whitelist_teams:
+      - "forgebot"
+    merge_whitelist_teams:
+      - "forgebot"

config/git.unkin.net/unkin/repository/forgebot.yaml

@@ -0,0 +1,16 @@
+description: "K8s operator + API for AI agent dispatch from git forges"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_teams:
+      - "forgebot"
+    merge_whitelist_teams:
+      - "forgebot"

config/git.unkin.net/unkin/repository/node-lookup.yaml

@@ -12,4 +12,3 @@ branch_protection:
       - "ci/woodpecker/pr/unit-tests"
     approval_whitelist_users:
       - "unkinben"
-woodpecker: true

config/git.unkin.net/unkin/repository/puppet-prod.yaml

@@ -35,4 +35,3 @@ branch_protection:
       - "ci/woodpecker/pr/yamllint"
     approval_whitelist_teams:
       - "puppet"
-woodpecker: true

config/git.unkin.net/unkin/repository/puppet-r10k.yaml

@@ -13,4 +13,3 @@ branch_protection:
     approval_whitelist_teams:
       - "puppet"
     block_on_rejected_reviews: true
-woodpecker: true

config/git.unkin.net/unkin/repository/rpmbuilder.yaml

@@ -18,4 +18,3 @@ branch_protection:
     approval_whitelist_teams:
       - "rpmbuild"
     block_on_rejected_reviews: true
-woodpecker: true

config/git.unkin.net/unkin/repository/terraform-artifactapi.yaml

@@ -0,0 +1,18 @@
+description: "Terraform configuration for managing ArtifactAPI remote and virtual repositories"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    merge_whitelist_users:
+      - "benvin"
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "unkinben"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-authentik.yaml

@@ -0,0 +1,18 @@
+description: "Terraform configuration for managing Authentik identity provider"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    merge_whitelist_users:
+      - "benvin"
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "unkinben"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-git.yaml

@@ -0,0 +1,13 @@
+description: "Manage Gitea resources, teams, repos, and Woodpecker CI via Terraform"
+private: false
+default_branch: "main"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "unkinben"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-provider-artifactapi.yaml

@@ -4,6 +4,9 @@ default_delete_branch_after_merge: false
 branch_protection:
   - rule_name: "main"
     enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
     approval_whitelist_teams:
       - "Owners"
-woodpecker: true

config/git.unkin.net/unkin/repository/terraform-provider-litellmvaultsecret.yaml

@@ -0,0 +1,18 @@
+description: "Terraform provider for the Vault/OpenBao LiteLLM dynamic secrets engine (litellmvaultsecret)"
+private: false
+default_branch: "main"
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-prowlarr.yaml

@@ -0,0 +1,18 @@
+description: "Terraform configuration for managing Prowlarr indexer automation"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    merge_whitelist_users:
+      - "benvin"
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "unkinben"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-radarr.yaml

@@ -0,0 +1,18 @@
+description: "Terraform configuration for managing Radarr movie automation"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    merge_whitelist_users:
+      - "benvin"
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "unkinben"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-sonarr.yaml

@@ -0,0 +1,18 @@
+description: "Terraform configuration for managing Sonarr TV automation"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    merge_whitelist_users:
+      - "benvin"
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/plan"
+    approval_whitelist_users:
+      - "unkinben"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/terraform-vault.yaml

@@ -16,4 +16,3 @@ branch_protection:
       - "unkinben"
     approval_whitelist_teams:
       - "Owners"
-woodpecker: true

config/git.unkin.net/unkin/repository/tomswall.yaml

@@ -0,0 +1,8 @@
+description: "Spiritual successor to shorewall — nftables firewall manager using google/nftables"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    enable_push: false

config/git.unkin.net/unkin/repository/vault-plugin-secrets-litellm.yaml

@@ -0,0 +1,18 @@
+description: "HashiCorp Vault / OpenBao dynamic secrets engine for LiteLLM virtual keys"
+private: false
+default_branch: "main"
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/team/docker.yaml

@@ -1,5 +1,5 @@
 description: "manage docker related repositories"
-permission: write
+permission: none
 include_all_repositories: false
 can_create_repos: false
 repositories:

config/git.unkin.net/unkin/team/forgebot.yaml

@@ -0,0 +1,13 @@
+description: "forgebot maintainers"
+permission: none
+include_all_repositories: false
+can_create_repos: false
+repositories:
+  - forgebot
+  - forgebot-skills
+  - container-agent-base
+  - container-agent-dev
+  - container-agent-infra
+members:
+  - unkinben
+  - benvin

config/git.unkin.net/unkin/team/puppet.yaml

@@ -1,5 +1,5 @@
 description: "owners of the puppet system"
-permission: write
+permission: none
 include_all_repositories: false
 can_create_repos: false
 repositories:

config/git.unkin.net/unkin/team/pybuild.yaml

@@ -1,5 +1,5 @@
 description: "Python package builers"
-permission: write
+permission: none
 include_all_repositories: false
 can_create_repos: false
 repositories:

config/git.unkin.net/unkin/team/rpmbuild.yaml

@@ -1,5 +1,5 @@
 description: "manage rpmbuild repos"
-permission: write
+permission: none
 include_all_repositories: false
 can_create_repos: false
 repositories:

config/git.unkin.net/unkin/team/terraform.yaml

@@ -1,5 +1,5 @@
 description: "terraform job maintainers"
-permission: write
+permission: none
 include_all_repositories: false
 can_create_repos: false
 repositories:

environments/au/syd1/terragrunt.hcl

@@ -20,6 +20,5 @@ inputs = {
   organisation      = local.config.organisation
   repository        = local.config.repository
   branch_protection = local.config.branch_protection
-  deploy_key        = local.config.deploy_key
   team              = local.config.team
 }

environments/root.hcl

@@ -19,21 +19,6 @@ terraform {
     lock    = true
     ca_file = "/etc/pki/tls/certs/ca-bundle.crt"
   }
-  required_version = ">= 1.10"
-  required_providers {
-    gitea = {
-      source  = "go-gitea/gitea"
-      version = "0.7.0"
-    }
-    woodpecker = {
-      source  = "Kichiyaki/woodpecker"
-      version = "0.5.0"
-    }
-    consul = {
-      source  = "hashicorp/consul"
-      version = "2.23.0"
-    }
-  }
 }
 EOF
 }

modules/gitea_instance/imports.tf

@@ -143,6 +143,31 @@ import {
   id = "137"
 }
 
+import {
+  to = module.repository["git.unkin.net/unkin/forgebot"].gitea_repository.this
+  id = "139"
+}
+
+import {
+  to = module.repository["git.unkin.net/unkin/forgebot-skills"].gitea_repository.this
+  id = "140"
+}
+
+import {
+  to = module.repository["git.unkin.net/unkin/container-agent-base"].gitea_repository.this
+  id = "141"
+}
+
+import {
+  to = module.repository["git.unkin.net/unkin/container-agent-dev"].gitea_repository.this
+  id = "142"
+}
+
+import {
+  to = module.repository["git.unkin.net/unkin/container-agent-infra"].gitea_repository.this
+  id = "143"
+}
+
 import {
   to = module.team["git.unkin.net/unkin/Owners"].gitea_team.this
   id = "3"
@@ -174,46 +199,7 @@ import {
 }
 
 import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/puppet-prod"].woodpecker_repository.this
-  id = "unkin/puppet-prod"
+  to = module.repository["git.unkin.net/unkin/terraform-git"].gitea_repository.this
+  id = "144"
 }
 
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/puppet-r10k"].woodpecker_repository.this
-  id = "unkin/puppet-r10k"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-vault"].woodpecker_repository.this
-  id = "unkin/terraform-vault"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/rpmbuilder"].woodpecker_repository.this
-  id = "unkin/rpmbuilder"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/artifactapi"].woodpecker_repository.this
-  id = "unkin/artifactapi"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/argocd-apps"].woodpecker_repository.this
-  id = "unkin/argocd-apps"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/certmanager"].woodpecker_repository.this
-  id = "unkin/certmanager"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/node-lookup"].woodpecker_repository.this
-  id = "unkin/node-lookup"
-}
-
-import {
-  to = module.woodpecker_repository["git.unkin.net/unkin/terraform-provider-artifactapi"].woodpecker_repository.this
-  id = "unkin/terraform-provider-artifactapi"
-}

modules/gitea_instance/main.tf

@@ -55,18 +55,12 @@ module "team" {
   depends_on = [module.organisation, module.repository]
 }
 
-module "woodpecker_repository" {
-  source = "./modules/woodpecker_repository"
+removed {
+  from = module.woodpecker_repository
 
-  for_each = {
-    for k, v in var.repository : k => v
-    if try(v.woodpecker, false)
+  lifecycle {
+    destroy = false
   }
-
-  full_name  = "${each.value.organisation}/${each.value.name}"
-  visibility = each.value.private ? "private" : "public"
-
-  depends_on = [module.repository]
 }
 
 module "branch_protection" {
@@ -95,7 +89,7 @@ module "branch_protection" {
   protected_file_patterns           = each.value.protected_file_patterns
   unprotected_file_patterns         = each.value.unprotected_file_patterns
 
-  depends_on = [module.repository]
+  depends_on = [module.repository, module.team]
 }
 
 # TODO: enable when deploy keys are needed

modules/gitea_instance/modules/team/main.tf

@@ -6,6 +6,10 @@ resource "gitea_team" "this" {
   include_all_repositories = var.include_all_repositories
   can_create_repos         = var.can_create_repos
   repositories             = var.repositories
+
+  lifecycle {
+    ignore_changes = [permission]
+  }
 }
 
 resource "gitea_team_members" "this" {

modules/gitea_instance/modules/woodpecker_repository/main.tf

@@ -1,4 +0,0 @@
-resource "woodpecker_repository" "this" {
-  full_name  = var.full_name
-  visibility = var.visibility
-}

modules/gitea_instance/modules/woodpecker_repository/variables.tf

@@ -1,8 +0,0 @@
-variable "full_name" {
-  type = string
-}
-
-variable "visibility" {
-  type    = string
-  default = "internal"
-}

modules/gitea_instance/terraform.tf

@@ -1,6 +1,10 @@
 terraform {
   required_version = ">= 1.10"
   required_providers {
+    gitea = {
+      source  = "go-gitea/gitea"
+      version = "0.7.0"
+    }
     woodpecker = {
       source  = "Kichiyaki/woodpecker"
       version = "0.5.0"

modules/gitea_instance/variables.tf

@@ -15,8 +15,8 @@ variable "organisation" {
 variable "repository" {
   description = "Map of repositories to create"
   type = map(object({
-    name                              = string
-    organisation                      = string
+    name                    = string
+    organisation            = string
     description             = optional(string)
     private                 = optional(bool)
     default_branch          = optional(string)
@@ -32,7 +32,6 @@ variable "repository" {
     repo_template           = optional(bool)
     website                 = optional(string)
     autodetect_manual_merge = optional(bool)
-    woodpecker             = optional(bool, false)
   }))
   default = {}
 }
@@ -64,18 +63,6 @@ variable "branch_protection" {
   default = {}
 }
 
-variable "deploy_key" {
-  description = "Map of deploy keys to create"
-  type = map(object({
-    repository   = string
-    organisation = string
-    gitea_url    = string
-    title        = string
-    key          = string
-    read_only    = optional(bool, true)
-  }))
-  default = {}
-}
 
 variable "team" {
   description = "Map of teams to create"