Manage Gitea users; add teabot personality bot accounts #45

2026-07-27T17:22:49+10:00

unkinben commented

2026-07-27 17:22:49 +10:00

Why

teabot (unkin/teabot, just merged) dispatches Claude sessions using distinct
per-personality Gitea accounts so its work is attributable. Those accounts must
exist as static users. terraform-git already manages the Gitea instance
declaratively but had no way to manage users -- only orgs, repos, teams, and
branch protection. This adds a user config kind and uses it to provision
teabot's two personalities.

Account usernames match teabot's config.example.yaml / docs (teabot-implementer,
teabot-reviewer) so its personality logins resolve without further config.

Tokens are intentionally out of scope -- they will come from the upcoming
vault-plugin-secrets-gitea engine (or a static KV entry initially). The
gitea_user resource requires a password argument, so a per-user
random_password is generated; nothing sensitive is hardcoded and only a
placeholder lives in state.

How

Add a modules/user submodule that creates a gitea_user plus a
random_password for the required password (provider go-gitea/gitea 0.7.0,
already pinned -- it already ships the user resource, so no version bump).
Add a data-driven user config kind: drop config/git.unkin.net/user/<name>.yaml
and it becomes a user, mirroring how repositories and teams work
(config/config.hcl locals + variable "user" + module "user" + terragrunt input).
Add the hashicorp/random provider to the module required_providers.
Provision teabot-implementer and teabot-reviewer with a conservative
posture: admin: false, allow_create_organization: false,
max_repo_creation: 0, visibility: limited, send_notification off.
Ignore password drift on the user resource (the provider cannot read it back).

Notes for review

Watched-repo access grants (collaborator/team membership) are deliberately
left out -- they will be added once teabot's watch list is finalised. restricted
is available as a per-user field (default false) for when that happens.
Future bot users are yaml-only: add a file under config/git.unkin.net/user/.

## Why teabot (`unkin/teabot`, just merged) dispatches Claude sessions using distinct per-personality Gitea accounts so its work is attributable. Those accounts must exist as static users. terraform-git already manages the Gitea instance declaratively but had no way to manage users -- only orgs, repos, teams, and branch protection. This adds a user config kind and uses it to provision teabot's two personalities. Account usernames match teabot's `config.example.yaml` / docs (`teabot-implementer`, `teabot-reviewer`) so its personality logins resolve without further config. Tokens are intentionally out of scope -- they will come from the upcoming vault-plugin-secrets-gitea engine (or a static KV entry initially). The `gitea_user` resource requires a password argument, so a per-user `random_password` is generated; nothing sensitive is hardcoded and only a placeholder lives in state. ## How - Add a `modules/user` submodule that creates a `gitea_user` plus a `random_password` for the required password (provider `go-gitea/gitea 0.7.0`, already pinned -- it already ships the user resource, so no version bump). - Add a data-driven `user` config kind: drop `config/git.unkin.net/user/<name>.yaml` and it becomes a user, mirroring how repositories and teams work (`config/config.hcl` locals + `variable "user"` + `module "user"` + terragrunt input). - Add the `hashicorp/random` provider to the module `required_providers`. - Provision `teabot-implementer` and `teabot-reviewer` with a conservative posture: `admin: false`, `allow_create_organization: false`, `max_repo_creation: 0`, `visibility: limited`, `send_notification` off. - Ignore password drift on the user resource (the provider cannot read it back). ## Notes for review - Watched-repo access grants (collaborator/team membership) are deliberately left out -- they will be added once teabot's watch list is finalised. `restricted` is available as a per-user field (default false) for when that happens. - Future bot users are yaml-only: add a file under `config/git.unkin.net/user/`.

unkinben added 1 commit 2026-07-27 17:22:49 +10:00

Manage Gitea users; add teabot personality bot accounts

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

fd82876f5f

Add a data-driven 'user' config kind so Gitea accounts are declared as
config/git.unkin.net/user/<name>.yaml, mirroring the existing repository
and team kinds. Wire the yaml into a new modules/user submodule that
creates a gitea_user (provider go-gitea/gitea 0.7.0, already pinned).

The provider's user resource requires a password; generate a per-user
random_password so nothing sensitive is hardcoded and only a placeholder
lives in state (tokens come later from vault-plugin-secrets-gitea).

Provision teabot's implementer and reviewer personality accounts with a
conservative posture: not site admins, no org creation, no repo creation,
limited profile visibility.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

benvin merged commit 96092cf7a1 into main

2026-07-27 17:33:25 +10:00

benvin deleted branch benvin/teabot-users

2026-07-27 17:33:25 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-git#45