CI installed vault by shelling out to `dnf install vault -y`, which reads
metadata for every enabled repo (appstream/baseos/crb/epel/ha) and downloads
the 169MB vendored vault RPM from the unkin repo on every pipeline run
(~39s per plan/apply job).
- Replace the dnf install with a pinned curl of the upstream vault zip from
the artifactapi hashicorp-releases remote proxy, extracted with python3 to
/usr/local/bin/vault.
- Pin the version via a VAULT_VERSION env var (1.20.0).
terragrunt-enc will be the single source of truth for encapi ENC data
(statuses, roles, node classifications), managed via Terraform/Terragrunt,
superseding Cobbler classification for Puppet.
- Add config/git.unkin.net/unkin/repository/terragrunt-enc.yaml (public,
default_branch main, delete-branch-after-merge, squash merges).
- Protect main: block direct pushes, require the two Woodpecker PR status
checks (pre-commit, plan), and whitelist benvin for approvals.
The cephrgw-operator provisions Ceph RGW (S3) buckets and access keys from
Kubernetes CRDs via the Ceph manager dashboard API, and needs a Gitea repo
to host its code and run Woodpecker CI.
- Add config/git.unkin.net/unkin/repository/cephrgw-operator.yaml with the
standard public-repo settings (squash merge, delete branch on merge) and
main branch protection requiring the pre-commit/test/build PR checks.
Add branch protection to the openbao fork repository so main is protected: only
the owner may push directly and other changes must land via a pull request that
passes the fork build pipeline.
- Add branch_protection for main (whitelist-push to the owner; require the
ci/woodpecker/pr/build status check on PRs); set squash as the default merge
RFC2136 dynamic-DNS updater daemon (Go) that replaces the puppet dns-update
shell script. Squash merge, protected main with woodpecker build/test/pre-commit
status checks.
Create the Gitea repository for the private OpenBao fork so its integration
branch (main) can be pushed and hosted on git.unkin.net.
- Add config/git.unkin.net/unkin/repository/openbao.yaml (private, default branch
main, delete branch after merge)
The Terraform provider for the gpg secrets engine needs a Gitea repo to hold
its source and run its Woodpecker PR/release pipelines.
- Add config/git.unkin.net/unkin/repository/terraform-provider-gpgvaultsecret.yaml
(public, main default branch, squash-only, main branch protection gated on the
pre-commit/build/test PR checks), mirroring the sibling
terraform-provider-litellmvaultsecret repo.
passv (a Vault-backed drop-in for pass) needs a Gitea repo to hold its source
and run its Woodpecker PR/release pipelines.
- Add config/git.unkin.net/unkin/repository/passv.yaml (public, main default
branch, squash-only, main branch protection gated on the pre-commit/build/test
PR checks), mirroring the sibling vault-plugin-secrets-gpg repo.
Creates the two Gitea repositories backing the new Rancher token secrets engine:
a Vault/OpenBao plugin and its Terraform provider.
- Add config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml
(squash-only, main protected on pre-commit/build/test).
- Add config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml
(same protection profile as the litellm provider repo).
Provision the terraform-rancher Gitea repo, which will manage Rancher's
Authentik OIDC auth (keycloakoidc AuthConfig) via the rancher2 provider,
mirroring the terraform-authentik pattern.
The GPG/OpenPGP secrets engine needs a Gitea repo to hold its source and run
its Woodpecker PR/release pipelines.
- Add config/git.unkin.net/unkin/repository/vault-plugin-secrets-gpg.yaml
(public, main default branch, squash-only, main branch protection gated on
the pre-commit/build/test PR checks), mirroring the sibling
vault-plugin-secrets-bind-tsig repo.
Register a new public repo to host benvin-utils, a monorepo of small
single-purpose CLI tools (first tool: podgap) that share a common Go library.
- Add config/git.unkin.net/unkin/repository/benvin-utils.yaml (main default branch, delete branch after merge)
Declares the repo for a HashiCorp Vault / OpenBao secrets engine that
manages BIND TSIG keys via the bind-operator (static rotation + dynamic
creds). Mirrors the vault-plugin-secrets-litellm repo config.
Adds the Gitea repository that manages the Docker container build for the
jellyfin-ha (HA transcoding) Jellyfin fork.
- Create unkin/jellyfin-ha (public, squash merges, delete branch on merge)
- Protect main; require the ci/woodpecker/pr/build check and docker-team approval
Create the two Gitea repos backing the new Puppet ENC that replaces Cobbler:
- encapi: Go API + encapi-cli, Postgres-backed
- terraform-provider-encapi: Terraform provider for ENC roles/statuses/nodes
Both use main as default branch with squash-merge, delete-branch-after-merge,
and branch protection gated on the PR pipelines (pre-commit, test, build).
Merged PR branches should be cleaned up automatically everywhere, for a
consistent workflow across the estate.
- Flip default_delete_branch_after_merge from false to true on the 10 repos
that had it disabled.
- Add default_delete_branch_after_merge: true to the 3 repos that were missing
the field (terraform-git, terraform-provider-litellmvaultsecret,
vault-plugin-secrets-litellm).
node-lookup is being set up with build/test/pre-commit CI and a main-based
workflow, so its Gitea repo config needs to match.
- Change default_branch from master to main.
- Rename the branch protection rule to main and update the required status
checks to the new pipeline names (build, test, pre-commit) instead of the
old lint/unit-tests contexts.
Declares the bind-operator repo so Gitea provisions it for the new
Kubernetes operator that manages BIND9 DNS clusters.
- add config/git.unkin.net/unkin/repository/bind-operator.yaml with
main as default branch, squash merge, delete-branch-after-merge, and
branch protection requiring the pre-commit/test/build CI checks
Provision two new Gitea repos for the LiteLLM dynamic secrets work: the
Vault/OpenBao secrets-engine plugin and its companion Terraform provider.
- Add config/.../repository/vault-plugin-secrets-litellm.yaml
- Add config/.../repository/terraform-provider-litellm.yaml
- Default branch main, squash-only merging (allow_* flags, since the
go-gitea/gitea provider has no default_merge_style), and branch protection
on main requiring pre-commit/build/test checks with Owners approval
- Remove woodpecker_repository module and provider (repos managed outside TF)
- Add removed block with destroy=false to drop state without destroying
- Add module.team to branch_protection depends_on to prevent race condition
- Add lifecycle ignore_changes for team permission (provider bug: API returns
"none" but rejects it on write)
- Add forgebot team with unkinben and benvin members
- Enable branch protection on main for forgebot and forgebot-skills
- Team-based approval and merge whitelists
- Register both repos with Woodpecker CI
- CI status checks: pre-commit, test, build (forgebot); validate (skills)
2026-06-12 00:45:39 +10:00
63 changed files with 580 additions and 117 deletions
description:"RFC2136 dynamic-DNS updater daemon: watches a records file and network interfaces and pushes TSIG-signed updates to BIND, with a local status API for facter."
description:"Dependency-less Go CLI client for encapi, used as the Puppet exec External Node Classifier (ENC) on k8s compilers. Fetches the cobbler-wire ENC document and reshapes it for the puppet exec node_terminus."
description:"Merging HTTP proxy over two PuppetDB backends, presenting a single merged PuppetDB v4 query surface during the VM to k8s Puppet migration. Deployed in-cluster via argocd-apps."
description:"Single source of truth for encapi ENC data (statuses, roles, nodes), managed via Terraform/Terragrunt. Supersedes Cobbler node classification for Puppet."
description:"Fleet control plane for tomswall firewalls. Terraform-managed API that compiles fleet-wide zones, address groups, and firewall policy into per-device tomswall configs; agents pull and differentially apply."
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
unkinben
benvin
benvin