coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
138 commits 1 branch 0 tags 566 KiB
Commit graph

138 commits

This branch
This branch
All branches
Author SHA1 Message Date
tegwick
a307041cac docs(forgejo): document automated package prune retention policy
All checks were successful
CI Smoke / host-smoke (push) Successful in 11s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Reference ACTIVITY-WP-0020 weekly prune lane and depth-3 retention.
 2026-07-12 11:35:04 +02:00
custodian-sync
7d003a9d6c chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Updated by fix-consistency on 2026-07-12:
  - update .custodian-brief.md for railiance-apps
 2026-07-12 11:29:24 +02:00
tegwick
fd8537af7a docs(backup): close RAILIANCE-WP-0013 S5 Phase 1 gate
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Update app-data-backup-restore-handoff and vergabe-teilnahme with backup
and restore evidence references. Mark workplan finished and archive.
 2026-07-12 11:29:05 +02:00
tegwick
9b0b988e20 docs(backup): record successful forgejo-backup run for WP-0013 T03
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
forgejo-dump-20260711T233637Z uploaded after chunk-copy and preflight fixes.
 2026-07-12 10:53:01 +02:00
custodian-sync
96663283d2 chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Updated by fix-consistency on 2026-07-12:
  - update .custodian-brief.md for railiance-apps
 2026-07-12 01:11:41 +02:00
custodian-sync
22dc41a25d chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-12:
  - RAILIANCE-WP-0013-T05: progress → wait
 2026-07-12 01:11:39 +02:00
custodian-sync
8c89e54464 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-12:
  - RAILIANCE-WP-0013-T03: progress → wait
 2026-07-12 01:11:38 +02:00
tegwick
dc65a3b9fd feat(backup): apps-pg restore drill + close WP-0014
All checks were successful
CI Smoke / host-smoke (push) Successful in 7s
Details
CI Smoke / container-smoke (push) Successful in 8s
Details 
Add tools/apps-pg-restore-drill.sh and make target; T04 evidence for
vergabe_db row-count gate. Archive finished RAILIANCE-WP-0014.
 2026-07-12 01:09:49 +02:00
tegwick
a0cb579679 chore(vergabe): deploy tag 064d295 (Forgejo-only issue-core lock)
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details
2026-07-12 01:02:38 +02:00
tegwick
745874c7a0 docs(wp-0014): close vergabe Forgejo deploy (dfbc13a)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 21s
Details 
Image pushed to forgejo.coulomb.social and deployed on CoulombCore;
health smoke passed. Retires Gitea image for vergabe-teilnahme.
 2026-07-12 00:57:35 +02:00
tegwick
859d0051b3 docs(wp-0014): record Forgejo CI fix and deploy blocker
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details
2026-07-12 00:45:56 +02:00
tegwick
115d7a4095 chore(vergabe): target Forgejo image tag dfbc13a for deploy
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 1m2s
Details 
Align production values with the CI fix commit that unblocks Forgejo
container builds (uv sync --frozen).
 2026-07-12 00:45:17 +02:00
tegwick
d207f69f25 chore: add check-vergabe-image phony targets
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details
2026-07-12 00:34:21 +02:00
tegwick
e9f406da2a feat(vergabe): deploy from Forgejo OCI registry only
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details 
Switch helm values and Makefile image gates to forgejo.coulomb.social;
retire gitea.coulomb.social for vergabe-teilnahme production pulls.
 2026-07-12 00:32:32 +02:00
custodian-sync
4c32a65edd chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Updated by fix-consistency on 2026-07-12:
  - RAILIANCE-WP-0013-T03: progress → wait
 2026-07-12 00:24:35 +02:00
tegwick
7051adf1fe chore: restore T03 progress after partial cluster backup uploads
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
2026-07-12 00:24:17 +02:00
custodian-sync
1cb7634c6b chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details 
Updated by fix-consistency on 2026-07-12:
  - update .custodian-brief.md for railiance-apps
 2026-07-12 00:22:04 +02:00
custodian-sync
a1ff36d441 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-12:
  - RAILIANCE-WP-0013-T03: progress → wait
 2026-07-12 00:22:02 +02:00
tegwick
a4e4c3c5fb feat(backup): Phase 1 apps-pg lane uploads (RAILIANCE-WP-0013); pin vergabe 1061f3e (WP-0014)
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details
2026-07-12 00:21:06 +02:00
custodian-sync
6abaae4c4d chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 12s
Details 
Updated by fix-consistency on 2026-07-10:
  - update .custodian-brief.md for railiance-apps
 2026-07-10 21:48:03 +02:00
tegwick
e9ee577d03 WP-0014: Helm adopt and deploy Core Hub on CoulombCore; backup auth tooling
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 20s
Details 
Adopt live Core Hub resources, align prod ConfigMap naming, default production
image registry to gitea, and install Helm release core-hub rev 1 (smoke passed).
Add apps-pg-backup and check-backup-lane-auth targets; document OIDC login
requirement now that OpenBao is unsealed.
 2026-07-10 21:47:14 +02:00
custodian-sync
871c56692b chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 25s
Details 
Updated by fix-consistency on 2026-07-10:
  - update .custodian-brief.md for railiance-apps
 2026-07-10 15:46:27 +02:00
tegwick
a689270f18 WP-0013/0014: warden credential routing, CoulombCore kubeconfig, apps-pg backup dry-run
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 13s
Details 
Document OpenBao/warden paths for the offsite backup lane and flag the sealed
Vault blocker. Point production Makefile targets at CoulombCore, auto-discover
CNPG clusters in backup status, add apps-pg pg_dump dry-run tooling, and
record Core Hub Helm cutover findings (live gitea image, adopt required).
 2026-07-10 15:46:02 +02:00
custodian-sync
cd7e7035ce chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Updated by fix-consistency on 2026-07-10:
  - update .custodian-brief.md for railiance-apps
 2026-07-10 15:23:20 +02:00
custodian-sync
0c70f2cd05 chore(consistency): renormalize lifecycle state [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 1m47s
Details 
Updated by fix-consistency on 2026-07-10:
  - workplan status: ready → active
 2026-07-10 15:14:51 +02:00
custodian-sync
32a0988d19 chore(consistency): renormalize lifecycle state [auto] 
Updated by fix-consistency on 2026-07-10:
  - workplan status: ready → active
 2026-07-10 15:14:51 +02:00
tegwick
df7225dd3e RAILIANCE-WP-0012/0013/0014: Core Hub S5 release, CNPG observability, and follow-up workplans
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details 
Deliver the inbox-suggestion implementation from WP-0012: Core Hub Helm chart
and Makefile targets, CNPG backup status tooling, and updated backup handoff
docs. Archive the finished WP-0012 workplan and register ready follow-ups
WP-0013 (CNPG backup wiring + restore drill) and WP-0014 (Core Hub Helm
cutover and vergabe-teilnahme image refresh).
 2026-07-10 15:14:20 +02:00
custodian-sync
85f81714f1 chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 17s
Details 
Updated by fix-consistency on 2026-07-10:
  - update .custodian-brief.md for railiance-apps
 2026-07-10 15:13:45 +02:00
tegwick
04be41621d Migrate OCI image refs from Gitea to Forgejo registry
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 16s
Details 
Update charts, helm values, Makefile defaults, and operator docs to use
forgejo.coulomb.social for inter-hub, reuse-surface, and vergabe-teilnahme.
 2026-07-09 11:38:14 +02:00
tegwick
5c170d6331 CUST-WP-0055 T07: add archive workplan terminology grandfather note
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 6s
Details
2026-07-08 20:26:36 +02:00
tegwick
34783e4011 docs: workplan-first agent guidance prose (CUST-WP-0055 T04 batch 2)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
2026-07-08 16:41:13 +02:00
tegwick
3231e10625 Regenerate agent instructions from state-hub templates (CUST-WP-0055 T01)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Sync AGENTS.md, CLAUDE.md, and .claude/rules from updated project_rules
templates: workplan-first session protocol, legacy terminology footnote,
and GET /workplans/ examples.
 2026-07-08 14:50:33 +02:00
tegwick
b525faa896 docs(CORE-WP-0007): mark inter-hub railiance01 surface retired
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 17s
Details
2026-07-08 12:48:04 +02:00
tegwick
0968f1d5d5 Add reuse-webhook-smoke and rotation runbook links
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
RAILIANCE-WP-0011-T04: smoke checks unsigned 401, signed no-op 200, ESO Ready,
and /v1/federated; point operator docs at platform rotation runbook.
 2026-07-08 00:01:21 +02:00
tegwick
85e9163bb0 Point reuse-surface token export handoff at OpenBao path
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details 
Primary operator fetch is bao kv get per RAILIANCE-WP-0011-T03; kubectl
remains break-glass when OpenBao is unreachable.
 2026-07-07 22:38:45 +02:00
tegwick
40f0cb741d Deploy reuse-surface runtime secrets via OpenBao External Secrets
All checks were successful
CI Smoke / host-smoke (push) Successful in 3s
Details
CI Smoke / container-smoke (push) Successful in 48s
Details 
Add openbao-reuse ClusterSecretStore handoff, reuse-surface-runtime
ExternalSecret, ESO token bootstrap script, and Makefile targets for
CCR-2026-0005 / RAILIANCE-WP-0011.
 2026-07-07 22:34:34 +02:00
tegwick
3a9236148a Add Forgejo T05 verify, operator bootstrap, and security hardening
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Introduce forgejo-verify acceptance checks, idempotent operator bootstrap,
runner registration SOPS capture helper, and session/security Helm values.
 2026-07-07 22:09:53 +02:00
tegwick
9b31f229e8 Document reuse-surface runtime secrets and Forgejo org webhook
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Add runbook coverage for REUSE_SURFACE_TOKEN and
REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET in reuse-surface-env, plus an
idempotent make reuse-forgejo-webhook target that wires the coulomb org
push webhook to the hub receiver.
 2026-07-07 21:28:46 +02:00
tegwick
8f4486f978 Add SOPS-encrypted Forgejo runner registration secret
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Capture the in-cluster forgejo-runner-registration token into Git so
runner redeploys do not depend on a one-off kubectl create secret.
 2026-07-07 20:56:11 +02:00
tegwick
bcb05f5d95 Record e3ae22e deploy and flag /health ingress routing bug
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Found while smoke-testing the REUSE-WP-0019-T01/T02 deploy: GET
/v1/federated works (200) but the exact-path /health rule 404s at the
Traefik edge, shadowed by the catch-all / rule to reuse-surface-landing.
Confirmed pod/service-level health is fine (direct port-forward works,
readiness/liveness probes pass, pod is 1/1 Ready) -- this is an ingress
routing config issue affecting external monitoring only, not the API
itself. Not fixed here; needs a Traefik router priority annotation on
charts/reuse-surface/templates/ingress.yaml, a deliberate change to shared
production ingress outside this task's scope.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-07 20:14:29 +02:00
tegwick
a2c0da13c2 Deploy reuse-surface e3ae22e (REUSE-WP-0019-T01/T02)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Image update for the forge-host-abstraction and hub-webhook work:
composed_at/stale tracking on GET /v1/federated, new POST
/v1/webhooks/forgejo receiver (fails closed to 503 until
REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET is added to the reuse-surface-env
Secret -- deliberately not added yet, needs separate explicit
authorization for a production secret write), and the migrated
activity-core/state-hub Forgejo raw URLs already visible in the composed
index.

Live-verified post-deploy: /v1/federated (61 capabilities, composed_at/
stale fields present), /v1/repos, and a forced POST /v1/federated/compose
recompose all correct.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-07 20:13:09 +02:00
tegwick
3e211a1cb4 Fix Forgejo IONOS SMTP: STARTTLS on smtp.ionos.de
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Use PROTOCOL=smtp+starttls with the EU relay (smtp.ionos.de). Port 587 with
implicit TLS on smtp.ionos.com failed TLS handshake; .com auth also fails for
EU mailboxes. Document OpenBao PASSWD field mapping in operator docs.
 2026-07-07 16:40:12 +02:00
tegwick
d61173d66e Fix Forgejo mailer ESO field mapping and token bootstrap env
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details 
Map OpenBao key PASSWD to Secret MAILER_PASSWD so ExternalSecret syncs
against the live coulombcore path. Allow non-interactive bootstrap via
OPENBAO_TOKEN_FILE for make forgejo-openbao-eso-token-apply.
 2026-07-07 15:21:40 +02:00
tegwick
844a3503bb Add interim coulombcore OpenBao token bootstrap for Forgejo mailer ESO 
Document two OpenBao instances and add forgejo-openbao-eso-token-apply for
ClusterSecretStore openbao-forgejo on bao.coulomb.social.
 2026-07-07 14:35:49 +02:00
tegwick
d5bb4f66f2 Wire Forgejo SMTP password from OpenBao via External Secrets
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details 
Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the
synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.
 2026-07-07 14:30:02 +02:00
tegwick
24c8882b69 Enable IONOS SMTP mailer for Forgejo on railiance01
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Wire forgejo@coulomb.social via smtp.ionos.com:587 in Helm values and add
SOPS-encrypted mailbox password overlay for forgejo-deploy.
 2026-07-07 02:42:46 +02:00
tegwick
efb095ea2c Draft capability entry (reuse-surface REUSE-WP-0017-T04, cohort 3)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Honest first-pass maturity vector grounded in README/docs/tests present
in this repo; no invented evidence. Flagged for human review before
publish. See reuse-surface history/2026-07-06-coverage-classification.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-06 19:50:53 +02:00
tegwick
a74df4001b Add Forgejo CI smoke workflow (enablement template)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-04 12:49:57 +02:00
tegwick
28cbd3187c Fix in-cluster runner startup and readiness probes 
Wait for DinD before starting forgejo-runner daemon; use TCP/_ping
probes so the Deployment reports available once both containers are up.
 2026-07-03 22:32:34 +02:00
tegwick
0f0b340754 Add in-cluster Forgejo Actions runner manifests (ADR-004) 
DinD sidecar + forgejo-runner Deployment with PVC-backed registration
state. Makefile targets for registration secret, deploy, and status.
 2026-07-03 22:29:27 +02:00