jenkins
bbfa2018e2
gitea: preserve completed identity bootstrap job
2026-09-01 20:51:49 -03:00
jenkins
8d1302765f
gitea: migrate sources to titan/atlas-iac
2026-09-01 20:43:50 -03:00
jenkins
2019b08276
gitea: require literal branch protection rules
...
Replace the reimplemented gobwas/glob matcher with exact-literal rule
matching that fails closed on any special or malformed pattern, accepts
legacy zero priorities, and rejects duplicate primary-branch rules.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 15:15:35 -03:00
jenkins
8c6e3acdac
hermes: isolate Atlas SCM write authority
2026-08-17 07:58:44 -03:00
jenkins
89b9f1a4c7
hermes: isolate runtime access and expose activity
2026-08-15 22:15:40 -03:00
jenkins
441977449e
gitea: move Atlas repositories to organization
2026-08-14 23:55:28 -03:00
jenkins
2f45cc5997
gitea: enforce SSH directory modes
2026-08-13 20:26:43 -03:00
jenkins
a8262514fe
gitea: preserve SSH key permissions
2026-08-13 20:14:22 -03:00
jenkins
64862e0894
gitea: define Atlas contributor units
2026-08-13 19:43:33 -03:00
jenkins
7345c34b54
gitea: add Atlas contributor identities
2026-08-13 19:33:33 -03:00
jenkins
ba53dbab80
fix(gitea): raise the memory ceiling; time-bound the demo cleanup calls
...
Gitea wedged at 2073Mi against a 2Gi limit: its API stopped answering even on
its own loopback, and the repeated SSH LoginGraceTime drops in its log were
starvation symptoms rather than a separate fault. Raised to 3Gi.
The reset command's Gitea calls had no --max-time, so a slow service became an
indefinite hang with no output - the script appeared frozen after 'clearing
bstein/hermes-code-demo'. They now fail after 25 seconds and say so.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-06 20:04:42 -03:00
jenkins
8f45f47e60
refactor: restructure services layout, retire oceanus, add aether scaffolding
...
- Move flat service manifests into structured subdirs (apps/, bootstrap-jobs/,
repair-jobs/, migration-jobs/, validation-jobs/, node-ops/, networking/)
- Retire oneoffs/ directories across services
- Remove oceanus cluster and its host roles; add aether cluster + terraform scaffolding
- Reorganize scripts/ into ops/, render/, sync/, manual-tests/
- Add Makefile with render/validate/test/flux targets and repo-structure tests
- Update flux-system application CRs to the new paths
- Add hermes-automated-triage-24h-plan knowledge doc (+ comms mirror)
- Refresh knowledge catalogs, dashboards, vmalert rules, quality contract
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 16:21:36 -03:00
jenkins
2cd6ecc05d
maintenance: drop completed wait-bound oneoffs
2026-07-14 17:21:27 -03:00
jenkins
6d200d79ae
maintenance: expire completed one-off jobs
2026-07-14 17:10:18 -03:00
jenkins
56366f36f9
Fix Veles feedback ACL one-off command
2026-06-29 16:37:16 -03:00
jenkins
d06433d52b
Rerun Veles feedback ACL one-off
2026-06-29 16:27:17 -03:00
jenkins
6faf4b971d
Make Veles feedback issues publicly readable
2026-06-29 16:11:20 -03:00
jenkins
1aeddf6542
gitea: place Veles ACL one-off on rpi5
2026-06-20 15:19:11 -03:00
jenkins
4a9ac01273
gitea: constrain Veles tester feedback access
2026-06-20 15:12:51 -03:00
jenkins
0b92faa8bb
gitea: request groups for Veles OIDC
2026-06-20 14:43:24 -03:00
jenkins
74ab9bc78b
gitea: wire Veles OIDC login
2026-06-20 14:08:18 -03:00
jenkins
281cc058d8
ops: add resource guardrails for rpi workers
2026-05-19 12:48:40 -03:00
5a577630df
platform: expose metis on sentinel and move gitea to rpi5
2026-03-31 16:44:41 -03:00
f0855b7a3f
gitea: allow jenkins webhook
2026-01-20 09:06:39 -03:00
4de2e96f4d
gitea: expose ssh via metallb shared IP
2026-01-15 16:39:04 -03:00
04a58b43d6
core: add bstein.dev coredns overrides
2026-01-15 16:29:32 -03:00
558c1a0b32
gitea: tolerate oidc init failures
2026-01-14 13:46:34 -03:00
6d46ca1e3b
gitea: trim vault secret newlines
2026-01-14 13:43:56 -03:00
4279db1619
vault: stabilize injector templates and add health apps
2026-01-14 13:40:29 -03:00
3c5032f12f
gitea: run vault init first
2026-01-14 12:44:49 -03:00
9c99e68ad8
vault: move core apps to injector
2026-01-14 12:28:10 -03:00
13583a9a87
fix(gitea): inline vault secrets
2026-01-14 03:11:53 -03:00
306ed18c80
fix: resolve gitea mounts and bump portal job
2026-01-14 03:00:10 -03:00
3c65695dfc
vault: wire more services to CSI
2026-01-14 02:54:59 -03:00
1430f34851
gitea: auto-link oidc accounts
2026-01-13 12:47:41 -03:00
bc0c85a9ca
zot: add oauth proxy and user sync scripts
2025-12-15 12:57:02 -03:00
43f5b4ae08
gitea: enable OIDC auto-registration
2025-12-14 23:08:38 -03:00
d76d04dbc1
gitea: add proxy/session headers for OIDC
2025-12-14 22:25:46 -03:00
6656f01d8f
gitea: reference secret via env; remove secret file
2025-12-14 22:16:49 -03:00
b9a20eac55
gitea: remove committed secret and env refs
2025-12-14 22:10:13 -03:00
0db9ad6f41
gitea: pin secret/internal token and include secret manifest
2025-12-14 22:06:25 -03:00
555878cf06
gitea: drop required claim constraint on keycloak auth
2025-12-14 21:58:36 -03:00
d44d9d2307
gitea: enforce keycloak auth source via init container
2025-12-14 21:54:18 -03:00
ba7fe0603d
gitea: remove bootstrap job (immutable error)
2025-12-14 21:49:07 -03:00
52c273efd6
gitea: fix bootstrap job immutability
2025-12-14 21:47:50 -03:00
d86ba7b412
gitea: set trace logging for oidc
2025-12-14 21:44:43 -03:00
d5b08479e7
gitea: relax required signin, set admin group+skip 2fa
2025-12-14 21:42:08 -03:00
ae3d9b2bf9
gitea: enable debug logging for oauth
2025-12-14 21:38:32 -03:00
dcd38a1eff
ci: enable oidc for jenkins/gitops/gitea
2025-12-14 20:58:57 -03:00
78a542b81a
standardize cert issuers to letsencrypt
2025-12-12 15:18:40 -03:00
