Merge branch 'main' into benvin/update1

feat: add terraform-git
- add new repo - change write -> none
2026-06-11 23:32:17 +10:00 · 2026-06-11 00:52:50 +10:00
119 changed files with 121 additions and 1677 deletions
@@ -7,10 +7,9 @@ steps:
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
-      VAULT_VERSION: "1.20.0"
    commands:
-      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
-      - make apply
+      - dnf install vault -y
+      - make apply-if-changes
    backend_options:
      kubernetes:
        serviceAccountName: terraform-git
@@ -6,9 +6,8 @@ steps:
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
-      VAULT_VERSION: "1.20.0"
    commands:
-      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
+      - dnf install vault -y
      - make plan
    backend_options:
      kubernetes:
@@ -23,7 +23,7 @@ init:

 plan: init
 	@$(call vault_env) && \
-	terragrunt run --all --parallelism 4 --non-interactive plan -- -lock=false
+	terragrunt run --all --parallelism 4 --non-interactive plan

 apply-if-changes: init
 	@$(call vault_env) && \
@@ -33,14 +33,6 @@ locals {
      })
      if length(regexall("/team/", file_path)) > 0
    }
-    user = {
-      for file_path, content in local.all_configs :
-      "${split("/", file_path)[0]}/${trimsuffix(basename(file_path), ".yaml")}" => merge(content, {
-        username  = trimsuffix(basename(file_path), ".yaml")
-        gitea_url = split("/", file_path)[0]
-      })
-      if length(regexall("/user/", file_path)) > 0
-    }
    branch_protection = merge([
      for file_path, content in local.all_configs : {
        for idx, rule in try(content.branch_protection, []) :
@@ -1,16 +0,0 @@
-description: "Simple API for showing a users age"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "Owners"
-    merge_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "CLI tools for orchestrator PR automation as unkin-agent"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,9 +1,4 @@
 description: "Sudaporn's Research Data visualisation, normalised "
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,9 +1,4 @@
 description: "Sudaporn's Research Data visualisation, normalised"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -4,12 +4,10 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
    enable_push: false
    status_check_contexts:
      - "ci/woodpecker/pr/pre-commit"
      - "ci/woodpecker/pr/kubeconform"
-      - "ci/woodpecker/pr/vector-test"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true
@@ -1,16 +0,0 @@
-description: "arrstack reverse proxy: oauth2-gated UI + per-user API-key broker"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -5,12 +5,11 @@ default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
  - rule_name: "master"
-    merge_whitelist_teams:
-      - "Owners"
    enable_push: false
    status_check_contexts:
      - "ci/woodpecker/pr/pre-commit"
      - "ci/woodpecker/pr/test"
      - "ci/woodpecker/pr/build"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true
@@ -1,16 +0,0 @@
-description: "Kubernetes operator that provisions S3 buckets and backup schedules from backups.unkin.net/* annotations on PVCs and CNPG clusters"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,9 +0,0 @@
-description: "Monorepo of small single-purpose CLI tools sharing a common library"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Kubernetes operator for managing BIND9 DNS clusters, zones, views, and TSIG keys"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,15 +0,0 @@
-description: "Builds AlmaLinux node rootfs tarballs for bootapi image-based provisioning; on v* tag publishes almalinux9-node-<ver>.tar.zst to the artifactapi rootfs-images repo."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/lint"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,15 +0,0 @@
-description: "Live kickstart/iPXE templates + distro catalog for bootapi. Pulled by bootapi via git-sync; CI validates templates render for every distro."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/validate"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,16 +0,0 @@
-description: "PXE/kickstart boot service replacing Cobbler. Renders kickstart + iPXE from NetBox data over HTTP. Go API."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,16 +0,0 @@
-description: "Kubernetes operator that provisions Ceph RGW (S3) buckets and access keys (RW/RO) from CRDs via the Ceph manager dashboard API"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,11 +1,12 @@
 description: "Vault PKI certificate issuance and SSH host key signing tool for Puppet-managed infrastructure"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 branch_protection:
  - rule_name: "master"
    enable_push: false
    merge_whitelist_users:
-      - "benvin"
+      - "unkinben"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true
@@ -1,14 +0,0 @@
-description: "CLI tools (chcat, chtail, chgrep) for searching, filtering and tailing logs in the ClickHouse log store"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
@@ -1,15 +0,0 @@
-description: "Base container image for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
-      - "forgebot"
@@ -1,15 +0,0 @@
-description: "Dev toolchain container for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
-      - "forgebot"
@@ -1,15 +0,0 @@
-description: "Infrastructure toolchain container for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
-      - "forgebot"
@@ -1,8 +1,3 @@
 description: "Docker image to be used in Kubernetes as a developers container"
 private: false
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,16 +0,0 @@
-description: "RFC2136 dynamic-DNS updater daemon: watches a records file and network interfaces and pushes TSIG-signed updates to BIND, with a local status API for facter."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -3,8 +3,3 @@ private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
 repo_template: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Postgres-backed External Node Classifier (ENC) for Puppet, replacing Cobbler. Go API + encapi-cli."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,16 +0,0 @@
-description: "Dependency-less Go CLI client for encapi, used as the Puppet exec External Node Classifier (ENC) on k8s compilers. Fetches the cobbler-wire ENC document and reshapes it for the puppet exec node_terminus."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,14 +0,0 @@
-description: "Skill definitions for forgebot agents"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/validate"
-    approval_whitelist_teams:
-      - "forgebot"
-    merge_whitelist_teams:
-      - "forgebot"
@@ -1,16 +0,0 @@
-description: "K8s operator + API for AI agent dispatch from git forges"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "forgebot"
-    merge_whitelist_teams:
-      - "forgebot"
@@ -1,17 +0,0 @@
-description: "Fork of goodtune/ghp (GitHub proxy) with unkin patches"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Whitelist-push: the owner can push main directly (needed for the initial
-    # push and the fork's maintenance workflow); everyone else must open a PR.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    # PRs to main must pass the fork build/vet pipeline before merge.
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
@@ -1,14 +0,0 @@
-description: "Shared Go library for estate services: postgres, http service kit, vault and gitea clients"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
@@ -1,8 +1,3 @@
 description: "A repository for building initrd.img in docker "
 private: false
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,11 +0,0 @@
-description: "Source fork of ZoltyMat/jellyfin-ha carrying HA patches"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/ci"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,14 +0,0 @@
-description: "Container build for the jellyfin-ha (HA transcoding) Jellyfin fork"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
@@ -1,16 +0,0 @@
-description: "Kubernetes operator for managing Kea DHCP clusters, subnets, and PXE client classes"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Archives raw logs from NATS JetStream to S3 as zstd-compressed, GPG-encrypted, indexed objects; plus a CLI to search and retrieve them. Go service + CLI."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,14 +0,0 @@
-description: "Web UI for the ClickHouse log store: fuzzy find, tail and SQL-filter logs (logviewer.unkin.net)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
@@ -1,14 +0,0 @@
-description: "Keyboard-centric web UI to mark media as cheeztv (kids) content via hardlinks; oauth2-proxy fronted, talks to sonarr/radarr APIs"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
@@ -1,10 +0,0 @@
-description: "Media copy/move tool: Go API + UI spawning per-file k8s Jobs from mediafs CephFS to media PVCs; doubles as a Ceph aggregate-bandwidth test"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
@@ -1,16 +1,15 @@
 description: "A CLI tool written in Go that queries the PuppetDB API to look up and filter node facts."
 private: false
-default_branch: "main"
+default_branch: "master"
 default_delete_branch_after_merge: true
 default_merge_style: "squash"
 branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
+  - rule_name: "master"
    enable_push: false
    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/lint"
      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/unit-tests"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
+woodpecker: true
@@ -1,17 +0,0 @@
-description: "Private fork of OpenBao adding per-namespace raft, cross-cluster performance replicas, virtual KV, and KV events"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Whitelist-push: the owner can push main directly (needed for the initial
-    # push and the fork's maintenance workflow); everyone else must open a PR.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    # PRs to main must pass the fork build/vet pipeline before merge.
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
@@ -1,21 +0,0 @@
-description: "Vault-backed drop-in replacement for pass (password-store); routes GPG crypto through vault-plugin-secrets-gpg"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Merging HTTP proxy over two PuppetDB backends, presenting a single merged PuppetDB v4 query surface during the VM to k8s Puppet migration. Deployed in-cluster via argocd-apps."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,14 +0,0 @@
-description: "Woodpecker plugin-docker-buildx image with the internal Vault-PKI CA baked in (trusts artifactapi)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_teams:
-      - "docker"
@@ -1,16 +0,0 @@
-description: "Private fork of Prowlarr: Postgres backend + stateless multi-replica for the arrstack"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Owner can push main directly for fork maintenance (upstream-fix merges);
-    # everyone else opens a PR that must pass the Woodpecker image build.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/docker"
@@ -35,3 +35,4 @@ branch_protection:
      - "ci/woodpecker/pr/yamllint"
    approval_whitelist_teams:
      - "puppet"
+woodpecker: true
@@ -13,3 +13,4 @@ branch_protection:
    approval_whitelist_teams:
      - "puppet"
    block_on_rejected_reviews: true
+woodpecker: true
@@ -2,8 +2,3 @@ description: "A fastapi service to present puppet services via an api"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Private fork of Radarr: Postgres backend + stateless multi-replica for the arrstack"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Owner can push main directly for fork maintenance (upstream-fix merges);
-    # everyone else opens a PR that must pass the Woodpecker image build.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/docker"
@@ -1,14 +0,0 @@
-description: "API service that opens terraform-git PRs for new repo requests via kube Jobs; oauth2-proxy'd status UI"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
@@ -1,9 +1,4 @@
 description: "Package the internal ca-certificates"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "master"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,5 +1,5 @@
 description: "Build rpms for jellyfin-web"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 archived: true
@@ -18,3 +18,4 @@ branch_protection:
    approval_whitelist_teams:
      - "rpmbuild"
    block_on_rejected_reviews: true
+woodpecker: true
@@ -1,16 +0,0 @@
-description: "Private fork of Sonarr: Postgres backend + stateless multi-replica for the arrstack"
-private: true
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    # Owner can push main directly for fork maintenance (upstream-fix merges);
-    # everyone else opens a PR that must pass the Woodpecker image build.
-    enable_push: true
-    push_whitelist_users:
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/docker"
@@ -1,8 +1,3 @@
 description: "A stack of microservices that aim to offer a distributed streaming service."
 private: false
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    approval_whitelist_teams:
-      - "Owners"
+default_delete_branch_after_merge: false
@@ -1,16 +0,0 @@
-description: "A Go daemon that watches Gitea repos and dispatches one-shot Claude Code sessions in Docker to work issues and review PRs."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing ArtifactAPI remote and virtual repositories"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Authentik identity provider"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +1,14 @@
 description: "Manage Gitea resources, teams, repos, and Woodpecker CI via Terraform"
 private: false
 default_branch: "main"
-default_delete_branch_after_merge: true
+woodpecker: true
 branch_protection:
  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
    enable_push: false
    status_check_contexts:
      - "ci/woodpecker/pr/pre-commit"
      - "ci/woodpecker/pr/plan"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
    approval_whitelist_teams:
      - "Owners"
@@ -1,16 +0,0 @@
-description: "YAML-driven Terraform for NetBox IPAM, networks, and devices + Kea DHCP"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,8 +1,7 @@
 description: "Manage nomad with Terraform"
 private: false
 default_branch: "master"
-default_delete_branch_after_merge: true
-archived: true
+default_delete_branch_after_merge: false
 branch_protection:
  - rule_name: "master"
    enable_push: false
@@ -1,14 +1,9 @@
 description: "Terraform provider for managing ArtifactAPI"
 private: false
-default_delete_branch_after_merge: true
+default_delete_branch_after_merge: false
 branch_protection:
  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
    approval_whitelist_teams:
      - "Owners"
+woodpecker: true
@@ -1,16 +0,0 @@
-description: "Terraform provider for encapi: manage Puppet ENC roles, statuses, and node assignments."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao Gitea token secrets engine (giteavaultsecret)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao GPG/OpenPGP secrets engine (gpgvaultsecret) — manage backends and keys"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Terraform provider for the kea-operator KeaAPI: manage Kea DHCP subnets and PXE client classes."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao LiteLLM dynamic secrets engine (litellmvaultsecret)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao Rancher token secrets engine (ranchervaultsecret)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Terraform provider for tomswallapi: manage fleet-global firewall policy (zones, address groups, portgroups, rules, policies, fabrics) and per-device bindings."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,21 +0,0 @@
-description: "Terraform provider to manage the arrstack Vault secrets engine (config + roles)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao ghp token secrets engine (vault-secrets-ghp)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "Terraform provider for the Vault/OpenBao NetBox token secrets engine (pairs with vault-plugin-secrets-netbox)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Prowlarr indexer automation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Radarr movie automation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Rancher (auth, roles) via the rancher2 provider"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,18 +0,0 @@
-description: "Terraform configuration for managing Sonarr TV automation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    enable_push: false
-    merge_whitelist_users:
-      - "benvin"
-      - "unkinben"
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
-    approval_whitelist_teams:
-      - "Owners"
@@ -13,6 +13,7 @@ branch_protection:
      - "ci/woodpecker/pr/pre-commit"
      - "ci/woodpecker/pr/plan"
    approval_whitelist_users:
-      - "benvin"
+      - "unkinben"
    approval_whitelist_teams:
      - "Owners"
+woodpecker: true
@@ -1,15 +0,0 @@
-description: "Single source of truth for encapi ENC data (statuses, roles, nodes), managed via Terraform/Terragrunt. Supersedes Cobbler node classification for Puppet."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/plan"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,10 +0,0 @@
-description: "Spiritual successor to shorewall — nftables firewall manager using google/nftables"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
@@ -1,16 +0,0 @@
-description: "Fleet control plane for tomswall firewalls. Terraform-managed API that compiles fleet-wide zones, address groups, and firewall policy into per-device tomswall configs; agents pull and differentially apply."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/build"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine issuing short-lived signed JWT app tokens (per-app roles, offline JWKS validation) for self-made services"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "Vault/OpenBao secrets engine minting dynamic arrproxy per-user API tokens"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for BIND TSIG keys (static rotation + dynamic creds via bind-operator)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for ghp: mints ephemeral, scoped access tokens via the ghp admin API, authenticating as a static admin service token"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for Gitea: mints ephemeral, scoped per-user access tokens via the admin API, with seeded-admin basic-auth and root password rotation"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for GPG/OpenPGP keys (sign/verify/encrypt/decrypt, transit-style versioned keys, pass-compatible)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao dynamic secrets engine for LiteLLM virtual keys"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for NetBox API tokens (seeded admin + dynamic per-user tokens with expiry-aligned leases)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,21 +0,0 @@
-description: "HashiCorp Vault / OpenBao secrets engine for Rancher API tokens (seeded root rotation + dynamic scoped creds via tokens.ext.cattle.io)"
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-# Squash-only: the gitea provider has no "default merge style", so we restrict
-# the allowed styles to squash to force it.
-allow_merge_commits: false
-allow_rebase: false
-allow_rebase_explicit: false
-allow_squash_merge: true
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/pre-commit"
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-    approval_whitelist_teams:
-      - "Owners"
@@ -1,16 +0,0 @@
-description: "Monorepo of Go CLI tools for managing Vault tokens across multiple vault instances: vctl (login/renew per-context tokens) and vctx (context-aware wrapper around the vault CLI)."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,16 +0,0 @@
-description: "A small Go tool, shipped as a container image, used as a Kubernetes initContainer to block an app from starting until its database is ready."
-private: false
-default_branch: "main"
-default_delete_branch_after_merge: true
-default_merge_style: "squash"
-branch_protection:
-  - rule_name: "main"
-    merge_whitelist_teams:
-      - "Owners"
-    enable_push: false
-    status_check_contexts:
-      - "ci/woodpecker/pr/build"
-      - "ci/woodpecker/pr/test"
-      - "ci/woodpecker/pr/pre-commit"
-    approval_whitelist_users:
-      - "benvin"
@@ -1,14 +0,0 @@
-# Grants the unkin-agent bot Write across every unkin repository so Ben's AI
-# coding agents can push benvin/* branches and open pull requests. Write is the
-# minimum Gitea permission that allows pushing branches + creating PRs.
-#
-# Merge stays reserved for Ben: branch protection on every default branch sets a
-# merge whitelist of the Owners team only, so members of this team can push and
-# open PRs but cannot merge or approve. Keep this team out of every merge and
-# approval whitelist.
-description: "AI coding agents -- push branches + open PRs, never merge"
-permission: write
-include_all_repositories: true
-can_create_repos: false
-members:
-  - unkin-agent
@@ -1,13 +0,0 @@
-description: "forgebot maintainers"
-permission: none
-include_all_repositories: false
-can_create_repos: false
-repositories:
-  - forgebot
-  - forgebot-skills
-  - container-agent-base
-  - container-agent-dev
-  - container-agent-infra
-members:
-  - unkinben
-  - benvin
@@ -1,16 +0,0 @@
-# Least-privilege access for the repospawner bot: Write on terraform-git only,
-# which is the minimum Gitea permission that allows pushing a branch and opening
-# a pull request. repospawner does its whole job here (repo-creation PRs), so it
-# is kept out of the org-wide "agents" team (include_all_repositories: true).
-#
-# Merge stays reserved for Ben: branch protection on terraform-git's main sets a
-# merge whitelist of the Owners team only. Keep this team out of every merge and
-# approval whitelist.
-description: "repospawner bot -- push branches + open PRs on terraform-git only"
-permission: write
-include_all_repositories: false
-can_create_repos: false
-repositories:
-  - terraform-git
-members:
-  - repospawner
@@ -1,21 +0,0 @@
-# Purpose-built Gitea site-admin bot for the vault-plugin-secrets-gitea engine.
-# The engine seeds itself from this account's credentials (Basic Auth) to mint
-# and delete per-user tokens for any user. Its randomly generated password is
-# written ONCE to Vault KV (vault_seed_path below) and never updated after; the
-# Vault gitea engine reads that seed only when first creating gitea/config and
-# then rotates it (rotate-root) so only Vault holds the live password.
-#
-# A local (not external-auth) account with 2FA disabled is required so the
-# engine can change the password via the admin API during rotate-root.
-email: gitea-vault-admin@unkin.net
-full_name: "Gitea Vault Admin"
-description: "site-admin bot; credentials seeded to Vault for vault-plugin-secrets-gitea"
-# Site admin so the engine may mint/delete tokens for any user. No org/repo
-# creation; profile visible only to signed-in users.
-visibility: limited
-admin: true
-allow_create_organization: false
-max_repo_creation: 0
-# Seed this account's generated password to Vault KV (mount "kv") at this path,
-# where the Vault gitea secrets engine reads it at creation time. Written once.
-vault_seed_path: "service/vault/au/syd1/secret_backend/gitea/config"
@@ -1,22 +0,0 @@
-# Service identity for repospawner, which opens pull requests against this
-# repository (terraform-git) to add new Gitea repositories on request. It is
-# deliberately separate from unkin-agent so its access can stay scoped to the
-# single repository it needs: the "repospawner" team (unkin/team/repospawner.yaml)
-# grants Write on terraform-git and nothing else.
-#
-# Auth is via ephemeral API tokens minted by the vault-plugin-secrets-gitea
-# engine -- no usable credential lives in this repo's state beyond the generated
-# placeholder. Merge stays blocked by branch protection (merge whitelist =
-# Owners only), so it can push branches and open PRs but never merge.
-email: repospawner@unkin.net
-full_name: "Repo Spawner"
-description: "repospawner service identity -- opens repo-creation PRs against terraform-git"
-# Conservative bot posture: not a site admin, cannot create orgs or repos,
-# profile visible only to signed-in users.
-visibility: limited
-admin: false
-# Restricted: account can only see repos/orgs it is explicitly added to -- the
-# repospawner team grant on terraform-git is all it needs.
-restricted: true
-allow_create_organization: false
-max_repo_creation: 0
@@ -1,14 +0,0 @@
-# teabot "implementer" personality account.
-# Used by the teabot daemon (unkin/teabot) to open issues/PRs as a distinct
-# identity so its work is attributable. Auth is via an API token issued
-# out-of-band (vault-plugin-secrets-gitea / static KV) -- no token or usable
-# password lives in this repo's state beyond the generated placeholder.
-email: teabot-implementer@unkin.net
-full_name: "Teabot Implementer"
-description: "teabot implementer bot -- automated agent (unkin/teabot)"
-# Conservative bot posture: not a site admin, cannot create orgs or repos,
-# profile visible only to signed-in users.
-visibility: limited
-admin: false
-allow_create_organization: false
-max_repo_creation: 0
@@ -1,14 +0,0 @@
-# teabot "reviewer" personality account.
-# Used by the teabot daemon (unkin/teabot) to review pull requests as a distinct
-# identity so its reviews are attributable. Auth is via an API token issued
-# out-of-band (vault-plugin-secrets-gitea / static KV) -- no token or usable
-# password lives in this repo's state beyond the generated placeholder.
-email: teabot-reviewer@unkin.net
-full_name: "Teabot Reviewer"
-description: "teabot reviewer bot -- automated agent (unkin/teabot)"
-# Conservative bot posture: not a site admin, cannot create orgs or repos,
-# profile visible only to signed-in users.
-visibility: limited
-admin: false
-allow_create_organization: false
-max_repo_creation: 0
@@ -1,18 +0,0 @@
-# Shared identity used by Ben's AI coding agents to submit work (branches, pull
-# requests, issues, comments) as a distinct, attributable, least-privilege
-# account instead of Ben's own login. Auth is via ephemeral API tokens minted by
-# the vault-plugin-secrets-gitea engine (gitea/creds/unkin-agent) -- no token or
-# usable password lives in this repo's state beyond the generated placeholder.
-#
-# Write access comes from the "agents" team (team/agents.yaml); merge is blocked
-# by branch protection (merge whitelist = Owners only), so the agent can open and
-# comment on PRs/issues but never merge or approve.
-email: unkin-agent@unkin.net
-full_name: "Unkin Agent"
-description: "shared identity for automated AI coding agents -- write, never merge"
-# Conservative bot posture: not a site admin, cannot create orgs or repos,
-# profile visible only to signed-in users.
-visibility: limited
-admin: false
-allow_create_organization: false
-max_repo_creation: 0
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
benvin	5c784eff19	Merge branch 'main' into benvin/update1 ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details	2026-06-11 23:32:17 +10:00
unkinben	cee451f741	feat: add terraform-git ci/woodpecker/pr/pre-commit Pipeline failed Details ci/woodpecker/pr/plan Pipeline was successful Details - add new repo - change write -> none	2026-06-11 00:52:50 +10:00