From 72ec2c2979aa3f4d09da6f87faccc6fe03f45b31 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Tue, 14 Jul 2026 17:21:27 -0300
Subject: [PATCH] maintenance: drop completed wait-bound oneoffs

---
 services/gitea/kustomization.yaml             |   8 --
 .../veles-feedback-acl-ensure-job.yaml        |  54 --------
 .../scripts/veles_feedback_acl_ensure.sh      | 122 ------------------
 services/mailu/kustomization.yaml             |   1 -
 services/mailu/oneoffs/mailu-sync-job.yaml    | 103 ---------------
 5 files changed, 288 deletions(-)
 delete mode 100644 services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml
 delete mode 100644 services/gitea/scripts/veles_feedback_acl_ensure.sh
 delete mode 100644 services/mailu/oneoffs/mailu-sync-job.yaml

diff --git a/services/gitea/kustomization.yaml b/services/gitea/kustomization.yaml
index af30b68e7..b09f5fdf1 100644
--- a/services/gitea/kustomization.yaml
+++ b/services/gitea/kustomization.yaml
@@ -5,14 +5,6 @@ resources:
   - namespace.yaml
   - serviceaccount.yaml
   - pvc.yaml
-  - oneoffs/veles-feedback-acl-ensure-job.yaml
   - deployment.yaml
   - service.yaml
   - ingress.yaml
-configMapGenerator:
-  - name: veles-feedback-acl-ensure-script
-    namespace: gitea
-    files:
-      - scripts/veles_feedback_acl_ensure.sh
-generatorOptions:
-  disableNameSuffixHash: true
diff --git a/services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml b/services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml
deleted file mode 100644
index 53d946f4f..000000000
--- a/services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-# services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml
-# One-off job for gitea/veles-feedback-acl-ensure-4.
-# Purpose: keep Veles feedback anonymously readable while limiting write access
-# to testers/admins and avoiding source-code repository access.
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: veles-feedback-acl-ensure-4
-  namespace: gitea
-spec:
-  ttlSecondsAfterFinished: 3600
-  suspend: true
-  backoffLimit: 0
-  template:
-    metadata:
-      annotations:
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/role: "gitea"
-        vault.hashicorp.com/agent-inject-secret-gitea-db-secret__password: "kv/data/atlas/gitea/gitea-db-secret"
-        vault.hashicorp.com/agent-inject-template-gitea-db-secret__password: |
-          {{ with secret "kv/data/atlas/gitea/gitea-db-secret" }}
-          {{ .Data.data.password }}
-          {{ end }}
-    spec:
-      serviceAccountName: gitea-vault
-      restartPolicy: Never
-      volumes:
-        - name: veles-feedback-acl-ensure-script
-          configMap:
-            name: veles-feedback-acl-ensure-script
-            defaultMode: 0555
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: kubernetes.io/arch
-                    operator: In
-                    values: ["arm64"]
-                  - key: hardware
-                    operator: In
-                    values: ["rpi5"]
-                  - key: node-role.kubernetes.io/worker
-                    operator: Exists
-      containers:
-        - name: apply
-          image: postgres:15
-          command: ["/bin/sh"]
-          args: ["/scripts/veles_feedback_acl_ensure.sh"]
-          volumeMounts:
-            - name: veles-feedback-acl-ensure-script
-              mountPath: /scripts
-              readOnly: true
diff --git a/services/gitea/scripts/veles_feedback_acl_ensure.sh b/services/gitea/scripts/veles_feedback_acl_ensure.sh
deleted file mode 100644
index 8c8d57d0d..000000000
--- a/services/gitea/scripts/veles_feedback_acl_ensure.sh
+++ /dev/null
@@ -1,122 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-db_host="${GITEA_DB_HOST:-postgres-service.postgres.svc.cluster.local}"
-db_port="${GITEA_DB_PORT:-5432}"
-db_name="${GITEA_DB_NAME:-gitea}"
-db_user="${GITEA_DB_USER:-gitea}"
-org_name="${VELES_GITEA_ORG:-veles-alpha}"
-repo_name="${VELES_GITEA_FEEDBACK_REPO:-feedback}"
-team_name="${VELES_GITEA_TESTER_TEAM:-testers}"
-
-if [ ! -r /vault/secrets/gitea-db-secret__password ]; then
-  echo "Missing readable Vault secret file: /vault/secrets/gitea-db-secret__password" >&2
-  exit 1
-fi
-
-export PGPASSWORD
-PGPASSWORD="$(tr -d '\r\n' </vault/secrets/gitea-db-secret__password)"
-
-psql_base="psql -h ${db_host} -p ${db_port} -U ${db_user} -d ${db_name} -v ON_ERROR_STOP=1 -P pager=off"
-
-${psql_base} \
-  -v org_name="${org_name}" \
-  -v repo_name="${repo_name}" \
-  -v team_name="${team_name}" <<'SQL'
-begin;
-
-create temporary table veles_acl_ids on commit drop as
-select
-  org.id as org_id,
-  repo.id as repo_id,
-  team.id as team_id
-from gitea."user" org
-join gitea.repository repo
-  on repo.owner_id = org.id
-join gitea.team team
-  on team.org_id = org.id
-where org.lower_name = lower(:'org_name')
-  and org.type = 1
-  and repo.lower_name = lower(:'repo_name')
-  and team.lower_name = lower(:'team_name');
-
-do $$
-begin
-  if (select count(*) from veles_acl_ids) != 1 then
-    raise exception 'Expected one veles feedback ACL target, found %', (select count(*) from veles_acl_ids);
-  end if;
-end $$;
-
-update gitea.team team
-set authorize = 1,
-    includes_all_repositories = false,
-    can_create_org_repo = false
-from veles_acl_ids ids
-where team.id = ids.team_id;
-
-update gitea."user" org
-set visibility = 0
-from veles_acl_ids ids
-where org.id = ids.org_id;
-
-update gitea.repository repo
-set is_private = false
-from veles_acl_ids ids
-where repo.id = ids.repo_id;
-
-delete from gitea.repo_unit unit
-using veles_acl_ids ids
-where unit.repo_id = ids.repo_id
-  and unit.type in (1, 3, 4, 5, 6, 7, 8, 9, 10);
-
-insert into gitea.repo_unit (repo_id, type, config, created_unix, everyone_access_mode)
-select
-  ids.repo_id,
-  2,
-  '{"EnableTimetracker":false,"AllowOnlyContributorsToTrackTime":true,"EnableDependencies":true}',
-  extract(epoch from now())::bigint,
-  0
-from veles_acl_ids ids
-where not exists (
-  select 1
-  from gitea.repo_unit existing
-  where existing.repo_id = ids.repo_id
-    and existing.type = 2
-);
-
-insert into gitea.team_repo (org_id, team_id, repo_id)
-select ids.org_id, ids.team_id, ids.repo_id
-from veles_acl_ids ids
-where not exists (
-  select 1
-  from gitea.team_repo existing
-  where existing.team_id = ids.team_id
-    and existing.repo_id = ids.repo_id
-);
-
-delete from gitea.team_unit unit
-using veles_acl_ids ids
-where unit.team_id = ids.team_id
-  and unit.type in (1, 2, 3, 4, 5, 6, 7, 8, 9, 10);
-
-insert into gitea.team_unit (org_id, team_id, type, access_mode)
-select ids.org_id, ids.team_id, desired.type, desired.access_mode
-from veles_acl_ids ids
-cross join (
-  values
-    (1, 0),
-    (2, 2),
-    (3, 0),
-    (4, 0),
-    (5, 0),
-    (6, 0),
-    (7, 0),
-    (8, 0),
-    (9, 0),
-    (10, 0)
-) as desired(type, access_mode);
-
-commit;
-SQL
-
-echo "Veles feedback Gitea ACL ready"
diff --git a/services/mailu/kustomization.yaml b/services/mailu/kustomization.yaml
index 3e0494eed..285ada235 100644
--- a/services/mailu/kustomization.yaml
+++ b/services/mailu/kustomization.yaml
@@ -13,7 +13,6 @@ resources:
   - unbound-configmap.yaml
   - serverstransport.yaml
   - ingressroute.yaml
-  - oneoffs/mailu-sync-job.yaml
   - mailu-sync-cronjob.yaml
   - front-lb.yaml
 
diff --git a/services/mailu/oneoffs/mailu-sync-job.yaml b/services/mailu/oneoffs/mailu-sync-job.yaml
deleted file mode 100644
index f25b6eab1..000000000
--- a/services/mailu/oneoffs/mailu-sync-job.yaml
+++ /dev/null
@@ -1,103 +0,0 @@
-# services/mailu/oneoffs/mailu-sync-job.yaml
-# One-off job for mailu-mailserver/mailu-sync-9.
-# Purpose: mailu sync 9 (see container args/env in this file).
-# Run by setting spec.suspend to false, reconcile, then set it back to true.
-# Safe to delete the finished Job/pod; it should not run continuously.
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: mailu-sync-9
-  namespace: mailu-mailserver
-spec:
-  ttlSecondsAfterFinished: 3600
-  suspend: true
-  template:
-    metadata:
-      annotations:
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/role: "mailu-mailserver"
-        vault.hashicorp.com/agent-inject-secret-mailu-db-secret__database: "kv/data/atlas/mailu/mailu-db-secret"
-        vault.hashicorp.com/agent-inject-template-mailu-db-secret__database: |
-          {{- with secret "kv/data/atlas/mailu/mailu-db-secret" -}}{{ .Data.data.database }}{{- end -}}
-        vault.hashicorp.com/agent-inject-secret-mailu-db-secret__username: "kv/data/atlas/mailu/mailu-db-secret"
-        vault.hashicorp.com/agent-inject-template-mailu-db-secret__username: |
-          {{- with secret "kv/data/atlas/mailu/mailu-db-secret" -}}{{ .Data.data.username }}{{- end -}}
-        vault.hashicorp.com/agent-inject-secret-mailu-db-secret__password: "kv/data/atlas/mailu/mailu-db-secret"
-        vault.hashicorp.com/agent-inject-template-mailu-db-secret__password: |
-          {{- with secret "kv/data/atlas/mailu/mailu-db-secret" -}}{{ .Data.data.password }}{{- end -}}
-        vault.hashicorp.com/agent-inject-secret-mailu-sync-credentials__client-id: "kv/data/atlas/mailu/mailu-sync-credentials"
-        vault.hashicorp.com/agent-inject-template-mailu-sync-credentials__client-id: |
-          {{- with secret "kv/data/atlas/mailu/mailu-sync-credentials" -}}{{ index .Data.data "client-id" }}{{- end -}}
-        vault.hashicorp.com/agent-inject-secret-mailu-sync-credentials__client-secret: "kv/data/atlas/mailu/mailu-sync-credentials"
-        vault.hashicorp.com/agent-inject-template-mailu-sync-credentials__client-secret: |
-          {{- with secret "kv/data/atlas/mailu/mailu-sync-credentials" -}}{{ index .Data.data "client-secret" }}{{- end -}}
-        vault.hashicorp.com/agent-inject-secret-mailu-initial-account-secret__password: "kv/data/atlas/mailu/mailu-initial-account-secret"
-        vault.hashicorp.com/agent-inject-template-mailu-initial-account-secret__password: |
-          {{- with secret "kv/data/atlas/mailu/mailu-initial-account-secret" -}}{{ .Data.data.password }}{{- end -}}
-    spec:
-      restartPolicy: OnFailure
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/worker
-                    operator: Exists
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              preference:
-                matchExpressions:
-                  - key: kubernetes.io/arch
-                    operator: In
-                    values: ["arm64"]
-      serviceAccountName: mailu-vault-sync
-      containers:
-        - name: mailu-sync
-          image: python:3.11-alpine
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -euo pipefail
-              . /vault/scripts/mailu_vault_env.sh
-              pip install --no-cache-dir requests psycopg2-binary passlib >/tmp/pip.log \
-                && python /app/sync.py
-          env:
-            - name: KEYCLOAK_BASE_URL
-              value: http://keycloak.sso.svc.cluster.local
-            - name: KEYCLOAK_REALM
-              value: atlas
-            - name: MAILU_DOMAIN
-              value: bstein.dev
-            - name: MAILU_DEFAULT_QUOTA
-              value: "20000000000"
-            - name: MAILU_SYSTEM_USERS
-              value: no-reply-portal@bstein.dev,no-reply-vaultwarden@bstein.dev
-            - name: MAILU_DB_HOST
-              value: postgres-service.postgres.svc.cluster.local
-            - name: MAILU_DB_PORT
-              value: "5432"
-          volumeMounts:
-            - name: sync-script
-              mountPath: /app/sync.py
-              subPath: sync.py
-            - name: vault-scripts
-              mountPath: /vault/scripts
-              readOnly: true
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 200m
-              memory: 256Mi
-      volumes:
-        - name: sync-script
-          configMap:
-            name: mailu-sync-script
-            defaultMode: 0444
-        - name: vault-scripts
-          configMap:
-            name: mailu-vault-env
-            defaultMode: 0555