feat(binjovi-flux-deployer): deploy from a mirror source, roll back through Forgejo main #367

Merged

binjovi-bot merged 1 commit from feat/flux-deployer-mirror-source into trunk

2026-09-14 21:14:28 +00:00

sean commented

2026-09-14 21:13:43 +00:00

Owner

What

binjovi-flux-deploy v12 gains --mirror-url (exclusive with the retired --codeberg-repo, kept for the transition): Forgejo main is the deploy pointer, a Forgejo push mirror carries it to the off-cluster copy Flux reads, and the deployer only observes that copy (30 reads, 3 s apart; refuses a diverged mirror). Rollback moves Forgejo main back with --force-with-lease on the released revision, the token handed to git through a credential helper (never in argv), then waits for the mirror and Flux to follow.

Verified

scripts/check-binjovi-flux-deployer.sh: exclusive flags, URL validation, mirror observation on the ninth read, bounded failure, and a stubbed rollback whose push carries the lease and lands on code.sean.farm, with the mirror and Flux followed to the old revision. Green.

Follow-ups in the same sitting: binjovi (mirror_url flux targets, agents mount the Forgejo token, Dockerfile pin v12), binjovi-plans (mirror_url), seanfarm (Flux source → code.packet.town).

https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6

## What `binjovi-flux-deploy` v12 gains `--mirror-url` (exclusive with the retired `--codeberg-repo`, kept for the transition): Forgejo `main` is the deploy pointer, a Forgejo push mirror carries it to the off-cluster copy Flux reads, and the deployer only **observes** that copy (30 reads, 3 s apart; refuses a diverged mirror). Rollback moves Forgejo `main` back with `--force-with-lease` on the released revision, the token handed to git through a credential helper (never in argv), then waits for the mirror and Flux to follow. ## Verified `scripts/check-binjovi-flux-deployer.sh`: exclusive flags, URL validation, mirror observation on the ninth read, bounded failure, and a stubbed rollback whose push carries the lease and lands on `code.sean.farm`, with the mirror and Flux followed to the old revision. Green. Follow-ups in the same sitting: binjovi (`mirror_url` flux targets, agents mount the Forgejo token, Dockerfile pin v12), binjovi-plans (`mirror_url`), seanfarm (Flux source → `code.packet.town`). https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6

sean added 1 commit

2026-09-14 21:13:43 +00:00

feat(binjovi-flux-deployer): deploy from a mirror source, roll back through Forgejo main

binjovi/ci Binjovi completed the frozen plan

Details

48c35cef7e

Codeberg leaves the delivery path. Until now this deployer PUSHED the released
revision to Codeberg main with a deploy key, Flux read Codeberg, and a rollback
force-pushed Codeberg main back. The off-cluster chain replaces that: Forgejo
main is the deploy pointer, a Forgejo push mirror carries it to the copy Flux
reads (code.packet.town), and this deployer only OBSERVES that copy.

New shape, --mirror-url https://.../sean/<repo>.git, exclusive with the
retired --codeberg-repo, which stays for the transition:

  - the deployer clones Forgejo main and requires it to be the released
    revision, as before; from_revision is read from the mirror;
  - forward: refuse a diverged mirror (its main must be an ancestor of the
    revision), then wait for the mirror to show the revision -- thirty reads
    three seconds apart (confirm_mirror_main, the generalised
    confirm_codeberg_main), no push;
  - rollback: move Forgejo main back with --force-with-lease on the released
    revision, the credential handed to git through a helper that reads
    /secrets/forgejo/token (it never enters an argument list; the identity
    defaults to binjovi-bot), then wait for the mirror to follow, then the
    unchanged Flux source and Kustomization convergence. Rollback fails closed
    when the token is absent; Forgejo's branch protection must allow the
    deploy identity to force-push main, and a refusal is reported as such.

Version 11 -> 12. The check script drives both flows with a stubbed git and
kubectl: exclusive flags, URL validation, the mirror observation, and a
rollback whose push carries the lease on the released revision and lands on
Forgejo, with the mirror and Flux followed to the old revision.

sean/binjovi pins this image and passes --mirror-url from its catalog; that
follows in the same sitting.

Claude-Session: https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6