diff --git a/.claude/rules/stack-and-commands.md b/.claude/rules/stack-and-commands.md index d2f60f9..7f83894 100644 --- a/.claude/rules/stack-and-commands.md +++ b/.claude/rules/stack-and-commands.md @@ -7,15 +7,14 @@ ```bash make help # list all targets -make check-tools && make check-sops # preflight (read-only) -make gitea-status # forge runtime + database state (read-only) +make check-tools # preflight (read-only) +make forge-status # forge runtime + database state (read-only) make runner-status # Actions runner / registry probes (read-only) make registry-docs | evidence-docs | runner-docs # print canonical docs -make gitea-deploy | gitea-ingress-deploy # production-touching ``` -The `gitea-*` target names are kept for compatibility; the forge is Forgejo. -`make forgejo-status` is an alias for `gitea-status`. Do not run `gitea-deploy` -without review: the live release source is `railiance-apps/helm/forgejo-values.yaml`. -`gitea-deploy` / `gitea-ingress-deploy` change the production forge — -operator approval required. Status and docs targets are read-only. +This repo observes the forge; it does not deploy it. The live release source +is railiance-apps (`helm/forgejo-values.yaml`, `make forgejo-deploy`). The +former `gitea-deploy` / `gitea-ingress-deploy` targets carried stale values and +were retired (FORGE-WP-0009). They now refuse with a pointer. +`make forgejo-status` is an alias for `forge-status`. diff --git a/Makefile b/Makefile index 7b89a6e..be5a8fa 100644 --- a/Makefile +++ b/Makefile @@ -1,20 +1,18 @@ SHELL := /usr/bin/env bash .DEFAULT_GOAL := help -GITEA_RELEASE ?= forgejo -GITEA_NAMESPACE ?= forgejo -GITEA_CHART ?= gitea-charts/gitea -GITEA_VALUES ?= helm/gitea-values.sops.yaml -GITEA_REGISTRY_VALUES ?= helm/gitea-registry-values.yaml -GITEA_INGRESS ?= manifests/gitea-ingress.yaml -GITEA_HTTP_SERVICE ?= forgejo-gitea-http -GITEA_SSH_SERVICE ?= forgejo-ssh-nodeport -GITEA_DB_CLUSTER ?= forgejo-db -GITEA_DB_NAMESPACE ?= databases +# The live forge release source is railiance-apps (helm/forgejo-values.yaml, +# make forgejo-deploy). This repo only observes it (FORGE-WP-0009). +FORGE_RELEASE ?= forgejo +FORGE_NAMESPACE ?= forgejo +FORGE_HTTP_SERVICE ?= forge-http +FORGE_SSH_SERVICE ?= forgejo-ssh-nodeport +FORGE_DB_CLUSTER ?= forgejo-db +FORGE_DB_NAMESPACE ?= databases REGISTRY_DOCS ?= docs/gitea-container-registry.md docs/gitea-package-registry.md EVIDENCE_DOCS ?= docs/observability-operating-evidence.md docs/ci-runner-actions-gitops-ownership.md docs/backup-restore-secret-handoff.md RUNNER_DOCS ?= docs/gitea-actions-runner-substrate.md docs/gitea-actions-runner-evidence.md -SOPS_SENTINEL ?= $(GITEA_VALUES) +SOPS_SENTINEL ?= ##@ Operator checks @@ -35,7 +33,8 @@ check-tools: ## Check local tools used by forge operator targets fi; \ exit $$missing -check-sops: ## Verify the configured SOPS sentinel can decrypt +check-sops: ## Verify the given SOPS_SENTINEL file can decrypt + @test -n "$(SOPS_SENTINEL)" || { echo "set SOPS_SENTINEL=" >&2; exit 2; } sops -d $(SOPS_SENTINEL) >/dev/null registry-docs: ## Print canonical registry docs @@ -91,28 +90,24 @@ check-runner-tools: ## Check local tools used by runner inspection targets ##@ Current Forgejo (target names keep the legacy gitea- prefix) -gitea-deploy: ## Deploy / upgrade the Forgejo runtime via the Gitea chart (review first: live source is railiance-apps forgejo-values) - helm upgrade --install $(GITEA_RELEASE) $(GITEA_CHART) \ - -f <(sops -d $(GITEA_VALUES)) \ - -f $(GITEA_REGISTRY_VALUES) \ - --namespace $(GITEA_NAMESPACE) --create-namespace +gitea-deploy gitea-ingress-deploy forge-deploy: ## Removed: deploy the forge from railiance-apps + @echo "The forge is deployed from railiance-apps (make forgejo-deploy; see RAPPS-WP-0019 for the cutover order)." >&2 + @echo "This repo's former Gitea-chart targets carried stale values and are retired (FORGE-WP-0009)." >&2 + @exit 2 -gitea-ingress-deploy: ## Apply the public Forgejo HTTPS ingress - kubectl apply -f $(GITEA_INGRESS) +forgejo-status: forge-status ## Read-only status for the forge runtime and database (alias) -forgejo-status: gitea-status ## Read-only status for Forgejo runtime and database (alias) - -gitea-status: ## Read-only status for Forgejo runtime and database - kubectl get pods -n $(GITEA_NAMESPACE) -l app.kubernetes.io/instance=$(GITEA_RELEASE) - kubectl get svc -n $(GITEA_NAMESPACE) $(GITEA_HTTP_SERVICE) --ignore-not-found - kubectl get svc -n $(GITEA_NAMESPACE) $(GITEA_SSH_SERVICE) --ignore-not-found - kubectl get ingress -n $(GITEA_NAMESPACE) $(GITEA_RELEASE) --ignore-not-found - @if kubectl cnpg status $(GITEA_DB_CLUSTER) -n $(GITEA_DB_NAMESPACE) >/dev/null 2>&1; then \ - kubectl cnpg status $(GITEA_DB_CLUSTER) -n $(GITEA_DB_NAMESPACE); \ +forge-status: ## Read-only status for the forge runtime and database + kubectl get pods -n $(FORGE_NAMESPACE) -l app.kubernetes.io/instance=$(FORGE_RELEASE) + kubectl get svc -n $(FORGE_NAMESPACE) $(FORGE_HTTP_SERVICE) --ignore-not-found + kubectl get svc -n $(FORGE_NAMESPACE) $(FORGE_SSH_SERVICE) --ignore-not-found + kubectl get ingress -n $(FORGE_NAMESPACE) $(FORGE_RELEASE) --ignore-not-found + @if kubectl cnpg status $(FORGE_DB_CLUSTER) -n $(FORGE_DB_NAMESPACE) >/dev/null 2>&1; then \ + kubectl cnpg status $(FORGE_DB_CLUSTER) -n $(FORGE_DB_NAMESPACE); \ else \ echo "kubectl cnpg plugin not available; falling back to cnpg resources"; \ - kubectl get cluster $(GITEA_DB_CLUSTER) -n $(GITEA_DB_NAMESPACE); \ - kubectl get pods -n $(GITEA_DB_NAMESPACE) -l cnpg.io/cluster=$(GITEA_DB_CLUSTER); \ + kubectl get cluster $(FORGE_DB_CLUSTER) -n $(FORGE_DB_NAMESPACE); \ + kubectl get pods -n $(FORGE_DB_NAMESPACE) -l cnpg.io/cluster=$(FORGE_DB_CLUSTER); \ fi ##@ Help diff --git a/README.md b/README.md index 63333b5..74b3abd 100644 --- a/README.md +++ b/README.md @@ -39,6 +39,5 @@ make runner-docs make runner-status make check-runner-tools make check-tools -make gitea-status -make gitea-deploy +make forge-status ``` diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index a86d3bf..090aad2 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -12,9 +12,9 @@ | workplan | FORGE-WP-0006 | finished | — | workplans/FORGE-WP-0006-independent-secret-detection.md | | workplan | FORGE-WP-0007 | finished | — | workplans/FORGE-WP-0007-reuse-private-reader-contract-review.md | | workplan | FORGE-WP-0008 | proposed | — | workplans/FORGE-WP-0008-secret-detection-residual-coverage.md | -| workplan | FORGE-WP-0009 | proposed | — | workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md | +| workplan | FORGE-WP-0009 | finished | — | workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md | | workplan | FORGE-WP-0010 | finished | — | workplans/FORGE-WP-0010-receive-scanner-budget.md | -| workplan | FORGE-WP-0011 | active | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md | +| workplan | FORGE-WP-0011 | finished | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md | | workplan | RFORGE-WP-0002 | finished | — | workplans/RFORGE-WP-0002-forge-resource-economics-evidence.md | | task | FORGE-WP-ADHOC-2026-10-27-T01 | done | — | workplans/ADHOC-2026-10-27.md | | task | FORGE-WP-ADHOC-2026-10-27-T02 | done | — | workplans/ADHOC-2026-10-27.md | @@ -30,15 +30,15 @@ | task | FORGE-WP-0008-T04 | todo | — | workplans/FORGE-WP-0008-secret-detection-residual-coverage.md | | task | FORGE-WP-0008-T05 | todo | — | workplans/FORGE-WP-0008-secret-detection-residual-coverage.md | | task | FORGE-WP-0008-T06 | todo | — | workplans/FORGE-WP-0008-secret-detection-residual-coverage.md | -| task | FORGE-WP-0009-T01 | todo | — | workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md | -| task | FORGE-WP-0009-T02 | todo | — | workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md | +| task | FORGE-WP-0009-T01 | done | — | workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md | +| task | FORGE-WP-0009-T02 | done | — | workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md | | task | FORGE-WP-0010-T01 | done | — | workplans/FORGE-WP-0010-receive-scanner-budget.md | | task | FORGE-WP-0010-T02 | done | — | workplans/FORGE-WP-0010-receive-scanner-budget.md | | task | FORGE-WP-0010-T03 | done | — | workplans/FORGE-WP-0010-receive-scanner-budget.md | | task | FORGE-WP-0011-T01 | done | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md | | task | FORGE-WP-0011-T02 | done | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md | | task | FORGE-WP-0011-T03 | done | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md | -| task | FORGE-WP-0011-T04 | todo | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md | +| task | FORGE-WP-0011-T04 | done | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md | | task | RFORGE-WP-0002-T01 | done | — | workplans/RFORGE-WP-0002-forge-resource-economics-evidence.md | | task | RFORGE-WP-0002-T02 | done | — | workplans/RFORGE-WP-0002-forge-resource-economics-evidence.md | | task | RFORGE-WP-0002-T03 | done | — | workplans/RFORGE-WP-0002-forge-resource-economics-evidence.md | diff --git a/docs/backup-restore-secret-handoff.md b/docs/backup-restore-secret-handoff.md index 2ea7e02..7c3a7a2 100644 --- a/docs/backup-restore-secret-handoff.md +++ b/docs/backup-restore-secret-handoff.md @@ -1,5 +1,7 @@ # Backup, Restore, And Secret Handoff +> **2026-10-21 (FORGE-WP-0009):** the Gitea-chart deploy assets named here (the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml`, `releases/gitea/values.yaml`, `make gitea-deploy`, `make gitea-ingress-deploy`) were retired. The live forge release source is railiance-apps; this repo observes it. The rest of this document is kept as a record. + Last reviewed: 2026-06-05 Status: contract v1. This document defines ownership, evidence gates, and @@ -32,7 +34,7 @@ S5 application releases can trust without taking custody of forge secrets. | Asset | Current anchor | Forge responsibility | Platform/lower-layer responsibility | Trust gate | | --- | --- | --- | --- | --- | -| Gitea application database | CNPG cluster `databases/gitea-db`, checked by `make gitea-status` | State what must be restorable and what forge checks prove after restore | CNPG backup/restore implementation and database recovery mechanisms | Restored database must support login, repo list, package metadata, and registry metadata checks | +| Gitea application database | CNPG cluster `databases/gitea-db`, checked by `make forge-status` | State what must be restorable and what forge checks prove after restore | CNPG backup/restore implementation and database recovery mechanisms | Restored database must support login, repo list, package metadata, and registry metadata checks | | Gitea shared storage | PVC `default/gitea-shared-storage`, mounted at `/data`; package blobs under `/data/packages` | Track package/blob growth, retention posture, and restore requirements | Durable volume backup, object-storage export, or future storage replication | Restored storage must support Git clone, package download/install, and container pull checks | | Source repositories and forge app state | Gitea database plus `/data` storage | Define restore drill scope and consumer evidence | Database/PVC/object-storage restore tooling | Non-production restore drill proves a known repo can be cloned after restore | | Container and Python package registry data | Package blobs under `/data/packages`; metadata in Gitea database | Define retention, cleanup, package evidence, and consumer verification gates | Durable backup of blobs and metadata | Known image/package can be pulled or installed after restore | diff --git a/docs/current-forge-asset-inventory.md b/docs/current-forge-asset-inventory.md index 99412fc..885cf6e 100644 --- a/docs/current-forge-asset-inventory.md +++ b/docs/current-forge-asset-inventory.md @@ -1,5 +1,7 @@ # Current Forge Asset Inventory +> **2026-10-21 (FORGE-WP-0009):** the Gitea-chart deploy assets named here (the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml`, `releases/gitea/values.yaml`, `make gitea-deploy`, `make gitea-ingress-deploy`) were retired. The live forge release source is railiance-apps; this repo observes it. The rest of this document is kept as a record. + Date: 2026-06-05 This inventory covers forge-related assets that were originally visible in diff --git a/docs/deploy-capable-gitea-move-review.md b/docs/deploy-capable-gitea-move-review.md index 759c5c2..b8cc4f5 100644 --- a/docs/deploy-capable-gitea-move-review.md +++ b/docs/deploy-capable-gitea-move-review.md @@ -1,5 +1,7 @@ # Deploy-Capable Gitea Move Review +> **2026-10-21 (FORGE-WP-0009):** the Gitea-chart deploy assets named here (the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml`, `releases/gitea/values.yaml`, `make gitea-deploy`, `make gitea-ingress-deploy`) were retired. The live forge release source is railiance-apps; this repo observes it. The rest of this document is kept as a record. + Date: 2026-06-05 Status: executed as a file ownership move. No live Helm deploy, SOPS diff --git a/docs/first-migration-plan.md b/docs/first-migration-plan.md index cc765c2..6670485 100644 --- a/docs/first-migration-plan.md +++ b/docs/first-migration-plan.md @@ -1,5 +1,7 @@ # First Migration Plan +> **2026-10-21 (FORGE-WP-0009):** the Gitea-chart deploy assets named here (the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml`, `releases/gitea/values.yaml`, `make gitea-deploy`, `make gitea-ingress-deploy`) were retired. The live forge release source is railiance-apps; this repo observes it. The rest of this document is kept as a record. + Date: 2026-06-05 Status: Phases 1 through 3 are complete as file ownership moves. No live Helm diff --git a/docs/forgejo-actions-runner-substrate.md b/docs/forgejo-actions-runner-substrate.md index 3c21e0a..2a3b250 100644 --- a/docs/forgejo-actions-runner-substrate.md +++ b/docs/forgejo-actions-runner-substrate.md @@ -44,7 +44,7 @@ make forgejo-runner-status make forgejo-smoke # Generate registration token (in cluster; do not log token) -KUBECONFIG=~/.kube/config-hosteurope kubectl exec -n forgejo deploy/forgejo-gitea -- \ +KUBECONFIG=~/.kube/config-hosteurope kubectl exec -n forgejo deploy/forge -- \ forgejo actions generate-runner-token --scope coulomb ``` diff --git a/docs/gitea-container-registry.md b/docs/gitea-container-registry.md index 5282e55..680b45b 100644 --- a/docs/gitea-container-registry.md +++ b/docs/gitea-container-registry.md @@ -14,8 +14,8 @@ Do not use raw node IP HTTP ports for web or registry traffic; the Gitea HTTP Service is internal-only and the public standard is the HTTPS host. Registry-specific Gitea settings are carried in -`helm/gitea-registry-values.yaml`, a non-secret overlay applied after the SOPS -values file by `make gitea-deploy`. It explicitly enables packages, permits +`railiance-apps/helm/forgejo-registry-values.yaml`, a non-secret overlay applied after the SOPS +values file by `make forgejo-deploy` in railiance-apps. It explicitly enables packages, permits container and PyPI uploads without an app-level size cap, clears globally disabled repo units, and keeps `ROOT_URL` on the HTTPS host. diff --git a/docs/gitea-package-registry.md b/docs/gitea-package-registry.md index 986ab28..6e0e2b7 100644 --- a/docs/gitea-package-registry.md +++ b/docs/gitea-package-registry.md @@ -4,15 +4,15 @@ This is the canonical Railiance operating note for the current Gitea Python package registry. Compatibility pointers remain in `railiance-apps`; deploy-capable Gitea Helm and manifest files now live in this repo. -Gitea package support is enabled by `helm/gitea-registry-values.yaml`. That -overlay is applied after the encrypted base values by `make gitea-deploy` and +Gitea package support is enabled by `railiance-apps/helm/forgejo-registry-values.yaml`. That +overlay is applied after the encrypted base values by `make forgejo-deploy` in railiance-apps and enables both container packages and Python packages. The public ingress exposes the Gitea web route at `https://gitea.coulomb.social/`, the Python package route at `/api/packages`, and the OCI registry route at `/v2`. The standard endpoint is HTTPS; if package simple-index pages render `http://gitea.coulomb.social/...` artifact links, -reconcile the Gitea Helm release with `helm/gitea-registry-values.yaml` so +reconcile the Gitea Helm release with `railiance-apps/helm/forgejo-registry-values.yaml` so `ROOT_URL` is restored to the HTTPS host. Status on 2026-06-13: the root web route returns `200`, live `ROOT_URL` is diff --git a/docs/initial-operating-contracts.md b/docs/initial-operating-contracts.md index e819699..d5c6f3e 100644 --- a/docs/initial-operating-contracts.md +++ b/docs/initial-operating-contracts.md @@ -86,7 +86,7 @@ leaving live deploy and secret custody changes behind separate review gates. ## Observability And Evidence -- `make gitea-status` is the first read-only operator check in this repo. +- `make forge-status` is the first read-only operator check in this repo. - Forge health should cover web, Git SSH, container registry, Python package registry, database, package storage, and runner status. - Downstream app release evidence should cite forge artifact evidence rather diff --git a/docs/observability-operating-evidence.md b/docs/observability-operating-evidence.md index 3a70f31..9a79f85 100644 --- a/docs/observability-operating-evidence.md +++ b/docs/observability-operating-evidence.md @@ -37,7 +37,7 @@ This contract defines: ## Read-Only Health Checks -Run `make gitea-status` first. It checks the Gitea pod, Service, Ingress, and +Run `make forge-status` first. It checks the Gitea pod, Service, Ingress, and CNPG-backed `gitea-db` status when the operator has a kubeconfig pointed at the Railiance cluster. @@ -141,7 +141,7 @@ What to look for: Dashboard expectations: -- Current state: manual checks and `make gitea-status` are the authoritative +- Current state: manual checks and `make forge-status` are the authoritative operator path. - Next state: forge should publish signal definitions that a future dashboard can render without changing ownership boundaries. @@ -183,7 +183,7 @@ when any of these occur: - `/v2/` no longer returns an OCI registry response. - PyPI endpoint returns 5xx or package install checks fail for a published release package. -- `make gitea-status` shows unavailable pods, missing Service/Ingress, or an +- `make forge-status` shows unavailable pods, missing Service/Ingress, or an unhealthy `gitea-db`. - Package/blob usage crosses the warning or action thresholds above. - Runner labels required by S4 templates or S5 checks disappear. diff --git a/tests/test_forge_resources.py b/tests/test_forge_resources.py index ee600a9..19e71bb 100644 --- a/tests/test_forge_resources.py +++ b/tests/test_forge_resources.py @@ -13,7 +13,7 @@ SPEC.loader.exec_module(module) class ForgeResourceTests(unittest.TestCase): def test_resource_aggregation_and_residual(self) -> None: - deployment = {"metadata": {"name": "forgejo-gitea"}, "spec": {"replicas": 1, "template": {"spec": {"containers": [{"resources": {"requests": {"cpu": "100m", "memory": "128Mi"}, "limits": {"cpu": "1", "memory": "1Gi"}}}]}}}, "status": {"availableReplicas": 1}} + deployment = {"metadata": {"name": "forge"}, "spec": {"replicas": 1, "template": {"spec": {"containers": [{"resources": {"requests": {"cpu": "100m", "memory": "128Mi"}, "limits": {"cpu": "1", "memory": "1Gi"}}}]}}}, "status": {"availableReplicas": 1}} snapshot = { "deployments": {"items": [deployment]}, "pvcs": {"items": [{"metadata": {"name": "data"}, "spec": {"storageClassName": "local-path", "resources": {"requests": {"storage": "10Gi"}}}, "status": {"phase": "Bound"}}]}, diff --git a/tools/observe_forge_resources.py b/tools/observe_forge_resources.py index 76ff36e..5008dda 100755 --- a/tools/observe_forge_resources.py +++ b/tools/observe_forge_resources.py @@ -160,7 +160,7 @@ def build_observation(snapshot: dict[str, Any], captured_at: str) -> dict[str, A "kubectl top pods -n forgejo --no-headers", "kubectl get cluster forgejo-db -n databases -o json", "kubectl get backup,scheduledbackup -n databases -o json", - "kubectl exec deploy/forgejo-gitea -- du -sk /data", + "kubectl exec deploy/forge -- du -sk /data", "kubectl exec deploy/forgejo-runner -- du -sk /data", ], "repository_contents_read": False, @@ -191,7 +191,7 @@ def collect(remote: str | None, kubectl: str) -> dict[str, Any]: # Avoid an inner shell here: when kubectl is executed through SSH, shell # quoting can otherwise turn ``sh -c 'du ...'`` into ``sh -c du`` and # silently measure the container working directory instead of /data. - forge_du = run(prefix, ["exec", "-n", "forgejo", "deploy/forgejo-gitea", "-c", "gitea", "--", "du", "-sk", "/data"], optional=True) + forge_du = run(prefix, ["exec", "-n", "forgejo", "deploy/forge", "-c", "gitea", "--", "du", "-sk", "/data"], optional=True) runner_du = run(prefix, ["exec", "-n", "forgejo", "deploy/forgejo-runner", "-c", "runner", "--", "du", "-sk", "/data"], optional=True) def du_kib(output: str | None) -> int | None: diff --git a/workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md b/workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md index 516def1..30d7b57 100644 --- a/workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md +++ b/workplans/FORGE-WP-0009-retire-stale-gitea-deploy-assets.md @@ -4,7 +4,7 @@ type: workplan title: "Retire stale Gitea deploy target and CoulombCore Gitea values" domain: financials repo: railiance-forge -status: proposed +status: finished owner: codex topic_slug: railiance created: "2026-10-18" @@ -23,7 +23,7 @@ production change is part of this plan; it only removes or redirects repo files. ```task id: FORGE-WP-0009-T01 -status: todo +status: done priority: high state_hub_task_id: "4d5eed20-1177-5cc1-98b7-9deea5538679" ``` @@ -44,7 +44,7 @@ and README. Coordinate with railiance-apps owners if their docs point here ```task id: FORGE-WP-0009-T02 -status: todo +status: done priority: medium state_hub_task_id: "d83ccd89-c665-590c-8f11-f5023f47b6b2" ``` @@ -56,3 +56,22 @@ it and update the references in `docs/current-forge-asset-inventory.md` and `railiance-apps/docs/forgejo-on-railiance01.md`. If that placeholder was ever a real password anywhere, route its rotation through OpenBao custody (`warden route find`), not through this repo. + +## Done — 2026-10-21 + +This became urgent with the forge rename (railiance-apps RAPPS-WP-0019): `make +gitea-deploy` would have run `helm upgrade --install forgejo` with stale July +values and without the new `forge` names, overwriting production. + +- The `gitea-deploy` / `gitea-ingress-deploy` targets (and a `forge-deploy` name) + now refuse with a pointer to railiance-apps. +- The variables are now `FORGE_*` with the new names. The status target is + `forge-status`; `forgejo-status` remains an alias. +- `check-sops` takes an explicit `SOPS_SENTINEL`. +- Removed: the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml` + and `releases/gitea/values.yaml`. No live release uses them; nothing named gitea + runs in the cluster. The `changeme4` placeholder in the old CoulombCore values + was never a live credential on railiance01 (no such release exists), so nothing + needs rotating. +- The active docs, README and agent rules are corrected; the historical docs carry + a dated note. The resource observer now targets `deploy/forge`. Unit tests pass. diff --git a/workplans/FORGE-WP-0011-forgejo-resource-requests.md b/workplans/FORGE-WP-0011-forgejo-resource-requests.md index 10d3670..e07b49d 100644 --- a/workplans/FORGE-WP-0011-forgejo-resource-requests.md +++ b/workplans/FORGE-WP-0011-forgejo-resource-requests.md @@ -4,7 +4,7 @@ type: workplan title: "Size Forgejo and Actions runner requests from the 2026-10-21 allocation review" domain: financials repo: railiance-forge -status: active +status: finished owner: claude topic_slug: railiance-forge created: "2026-10-21" @@ -218,7 +218,7 @@ resource-control RESOURCE-WP-0008 and CUST-WP-0071 T04. ```task id: FORGE-WP-0011-T04 -status: todo +status: done priority: low state_hub_task_id: "851f2ffe-3d66-51fd-8c40-83c34b117713" ``` @@ -253,3 +253,9 @@ Rollback reference, if ever needed: `kubectl rollout undo deployment/forgejo-git ## Naming follow-up resolved by RAPPS-WP-0019 — 2026-10-21 The forge objects are now named `forge`, `forge-http` and `forge-ssh`, with pod label `forge` (railiance-apps RAPPS-WP-0019, Helm revision 11). Still left in T04: a runner container memory limit and the stale Error runner pod from 66 days ago. The data volume and the container names keep their chart-imposed legacy names. + +## Follow-ups done — 2026-10-21 + +- The runner container has a 1Gi memory limit (7-day peak 459Mi; `:host` jobs run inside it). The diff showed only that field; deployed with `make forgejo-runner-deploy`. +- The stale Error runner pod from 66 days ago was deleted. Namespace `forgejo` now holds only `forge` and `forgejo-runner`. +- The naming item was resolved by railiance-apps RAPPS-WP-0019.