Promote v0.1.0 to main #2

Merged

binjovi-bot merged 3 commits from trunk into main 2026-09-14 13:35:57 +00:00

Conversation 0 Commits 3 Files changed 4 +406 -1

binjovi-bot commented 2026-09-14 13:35:56 +00:00

Collaborator

Copy link

No description provided.

binjovi-bot added 3 commits 2026-09-14 13:35:56 +00:00

feat(outline): the wiki workload ... 195b639be6

Everything Outline needs exists in the cluster already -- namespace,
Postgres database, Valkey, RustFS bucket and key, OIDC client,
certificate, gateway listener, portal card. This is the workload that
uses them, and the HTTPRoute that finally gives outline.sean.farm a DNS
record: external-dns runs with --source=gateway-httproute, so the
listener alone resolves nothing.

Four settings carry more weight than they look:

  SECRET_KEY is 64 characters of which 64 are digits. server/env.ts
  carries @IsHexadecimal() and @Length(64, 64), and External Secrets
  cannot emit hex -- digits are a subset of hex, so this satisfies both.
  Allowing letters would produce g-z and Outline would refuse to boot.
  It is frozen: it encrypts stored data, and changing it locks every
  user out.

  DATABASE_URL is assembled here because Outline reads no other database
  variable, and the rotating password is urlquery-encoded. OpenBao
  rotates it hourly under a policy this repository does not control, and
  one '@' would re-point the connection at another host.

  OIDC discovery uses the PUBLIC issuer. The document carries the
  authorization endpoint the BROWSER is sent to, and a browser cannot
  reach hydra-public.ory.svc.

  The S3 endpoint is the stable ClusterIP with an explicit :9000. RustFS
  has no port-80 listener.

The image is the multi-arch index digest, verified against the registry
to carry a linux/arm64 child; the pod carries the arm-canary toleration.
Every node in this fleet is arm64.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

chore(outline): re-run the build on binjovi v0.1.736 ... 868727143d

The first build of this pull request failed in gitops_validate.v1 with
:invalid_task. The agent refused the source: sean/outline ->
manifests/outline was not in its @native_argocd_sources allow-list.
sean/binjovi #1778 added it to BOTH lists (Agent.Command and
ExecutionPlan) and shipped as v0.1.736, verified on binjovi-staging and
binjovi-production at 2026-09-14T12:59Z.

Binjovi builds on push, and there is no rebuild command, so this empty
commit is the re-run. No manifest changed.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

docs(outline): record why a wiki carries a tag protection ... a609798426

Onboarding declared branch protections for main and trunk and left the
`**` tag rule out, because Outline publishes no Git tags. That reading is
about the wrong thing: Forgejo.Authority.check/2 requires all three of
every provider-guarded project, to prove that nobody but binjovi-bot can
move a ref. `binjovictl authority outline` answered `blocked ·
invalid_tag_protection_response` and every release died 503.

The next person to read this repository should not have to rediscover
that from a reason code naming the shape of Forgejo's reply.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

binjovi-bot merged commit a609798426 into main 2026-09-14 13:35:57 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/outline!2

No description provided.