sean/platform-seanfarm
Watch
1
0
Fork
You've already forked platform-seanfarm
 0
Code Issues Pull requests 10 Projects Releases 120 Packages Wiki Activity
120 releases 120 tags
  • v0.1.9 9e201b6bc7

    v0.1.9 Stable

    pipeline-bot released this 2026-07-07 16:55:41 +00:00 | 476 commits to main since this release

    Removed

    • CNPG PgBouncer Pooler (postgres-pooler-rw) removed — incompatible with this cluster's
      external-CA design.       CNPG must sign the pooler's pgbouncer client cert with the CA private
      key, but our CA secret (postgres-server-tls) carries only ca.crt — the private key lives
      solely in OpenBao PKI and never enters the cluster (by design). The pooler wedged the CNPG
      cluster reconcile with cannot create Cluster auxiliary objects: missing ca.key secret data,
      latching phase: Unable to create required cluster objects (data plane stayed 5/5 healthy).
      max_connections=400 + shared_buffers=2GB (v0.1.7) already deliver the concurrency relief;
      a pooler would need ALL its TLS/auth secrets provided explicitly so CNPG never signs anything.

    Included changes (v0.1.8 -> v0.1.9)

    • 295155d0808e fix(cnpg): remove PgBouncer Pooler — incompatible with external-CA
    Downloads
  • v0.1.8 7e5621854c

    v0.1.8 Stable

    pipeline-bot released this 2026-07-07 16:24:23 +00:00 | 481 commits to main since this release

    Added

    • CNPG PgBouncer Pooler (postgres-pooler-rw, transaction mode, 3 replicas). Multiplexes many
      client conns onto ~25 server conns — the real scale fix beyond max_connections=400. Service
      postgres-pooler-rw.cnpg-platform.svc:5432. authQuery unset → CNPG auto-provisions the auth-query
      user. Only transaction-pool-SAFE consumers repoint here (Forgejo, next commit); Ory kratos/hydra
      (sslmode=require + prepared statements) + OpenBao/bootstrap Jobs (DDL/session) stay direct on -rw.

    Changed

    • openbao-operator manager cpu limit 500m->2 (crossplane XCluster patch; scheduling-free).

    Included changes (v0.1.7 -> v0.1.8)

    • cda21f56f1aa feat(concurrency): add CNPG PgBouncer Pooler (postgres-pooler-rw) + openbao-op limit
    Downloads
  • v0.1.7 82b392d44b

    v0.1.7 Stable

    pipeline-bot released this 2026-07-07 15:50:44 +00:00 | 486 commits to main since this release

    Changed

    • Concurrency raise (platform singletons). CNPG shared cluster: limits cpu 2->4 / mem 2->6Gi,
      requests 250m/768Mi->500m/2Gi, shared_buffers 512MB->2GB, effective_cache_size 1GB->4GB,
      max_connections 200->400 (the shared DB was the bottleneck for every land/CI; a PgBouncer Pooler
      for the real 10x is a deferred follow-up). MinIO pool requests cpu 100m->300m (x10 servers). Zot
      mem limit 512Mi->1Gi (tight under concurrent onDemand-sync). Requests kept modest — worker CPU is
      ~66-86%% committed after the mayastor io-engine 4-core bump.

    Included changes (v0.1.6 -> v0.1.7)

    • 5344a94ae574 feat(concurrency): raise CNPG (limits+max_connections 400+shared_buffers 2GB) + MinIO/Zot
    Downloads
  • v0.1.6 2319c99768

    v0.1.6 Stable

    pipeline-bot released this 2026-07-07 15:26:28 +00:00 | 491 commits to main since this release

    Changed

    • Forgejo scratch: zfs-nvme-32k → zfs-nvme-128k (pool tank/ephemeral). ZFS recordsize is a
      MAX not a fixed block, so small git objects use right-sized sub-blocks either way while packfiles
      (index-pack/unpack — the real scratch write cost) get fewer/larger 128k records = better
      sequential throughput + lz4 ratio. tank/databases (-32k) is for durable DBs; ephemeral scratch
      belongs on tank/ephemeral.

    Fixed

    • init-directories no longer skips the scratch mkdir on existing installs. [ ! -d /data/gitea/conf ] && mkdir returned exit 1 when the dir already existed (post-migration), and
      under set -e short-circuited the script BEFORE mkdir /scratch/local-repo /scratch/uploads —
      leaving PR test-merge / upload scratch dirs uncreated. Replaced with unconditional mkdir -p.

    Included changes (v0.1.5 -> v0.1.6)

    • 08f2ff9b33d0 fix(forgejo): scratch zfs-nvme-32k->128k (tank/ephemeral) + init-dir mkdir short-circuit
    Downloads
  • v0.1.5 e404d89ae0

    v0.1.5 Stable

    pipeline-bot released this 2026-07-07 13:30:35 +00:00 | 496 commits to main since this release

    Changed

    • Forgejo storage split — durable /data back onto replicated mayastor-repl2; scratch onto a
      separate node-local zfs-nvme ephemeral volume.       Corrects [0.1.4], which wrongly put the DURABLE
      git repos on node-local zfs (pinned to one node, not drain-safe). Durable data (canonical repos) now
      rides drain-safe mayastor-repl2 (repl2, not the old repl5); the high-churn git SCRATCH that
      actually benefits from fast local zfs + tunable block size — PR test-merges (LOCAL_COPY_PATH), git
      temp/unpacks (GITEA_TEMP), upload staging ([repository.upload] TEMP_PATH) — is split onto a
      per-pod generic-ephemeral zfs-nvme-32k volume at /scratch (recreatable, unpinned,
      recordsize-swappable). The pod is no longer node-pinned. Now that scratch is off mayastor, raised
      the patch-checker + global queue MAX_WORKERS 2 → 10 and the Forgejo CPU request 200m → 1 core.

    Included changes (v0.1.4 -> v0.1.5)

    • 4f9ed185de77 fix(forgejo): durable /data -> mayastor-repl2; split git scratch onto zfs-nvme
    Downloads
  • v0.1.4 088792430a

    v0.1.4 Stable

    pipeline-bot released this 2026-07-07 11:44:36 +00:00 | 501 commits to main since this release

    Changed

    • Forgejo /data PVC: mayastor → zfs-nvme-32k (node-local ZFS nvme). Moves the git-repo
      volume (incl. the PR test-merge scratch under [repository.local]) off replicated-nvmf mayastor
      onto node-local ZFS (pool tank/databases, recordsize 32k, lz4) — removes the storage-latency
      source of terminal PR-mergeability Error(4) under batch load, and lets us tune the ZFS block
      size for the git workload. TRADEOFF: openebs-zfs pins the volume to one node (not drain-safe like
      mayastor repl=3) — accepted; a node roll re-migrates or re-seeds. PVC renamed
      data-forgejo-0 → data-forgejo-zfs. Migration is data-preserving (copy while quiesced; the
      mayastor PVC is retained as fallback until the zfs copy is verified).

    Included changes (v0.1.3 -> v0.1.4)

    • bac1c5f353cf fix(forgejo): move /data mayastor -> zfs-nvme-32k (node-local, tunable block size)
    Downloads
  • v0.1.3 bce5563109

    v0.1.3 Stable

    pipeline-bot released this 2026-07-07 11:25:23 +00:00 | 506 commits to main since this release

    Changed

    • Forgejo 14.0.3 → 15.0.3 (LTS) — 14.x is a discontinued release line (no more
      security fixes); 15.0.3 is the current LTS (supported to 2027-07). forgejoVersion is
      now set explicitly in the XStack composition so the bump rolls the existing composite (a
      materialized XRD default does not re-apply). v15 is a one-way DB migration (auto-runs on
      startup; no downgrade) — verified our token scopes + all app.ini keys are v15-valid, and
      a surgical pg_dump of alice_forgejo is taken pre-roll for fast rollback. Expect a
      one-time re-login (v15 de-brands cookie names; moot given OIDC + session=memory).
    • Bound the PR patch-checker — [queue.pr_patch_checker] MAX_WORKERS=2. A transient
      error in an on-disk PR test-merge turns into a TERMINAL pr.Status=Error(4) (stale
      mergeable:false + merge API 405 "try again later" until a head push — Forgejo has no
      recompute lever), which wedged batch-lands 2026-07-07; capping concurrent test-merges
      keeps load bursts from inducing those failures.

    Included changes (v0.1.2 -> v0.1.3)

    • 16567486c823 fix(forgejo): upgrade 14.0.3->15.0.3 LTS + bound PR patch-checker
    Downloads
  • v0.1.2 b9f20ce9f4

    v0.1.2 Stable

    gitea_admin released this 2026-07-06 23:08:44 +00:00 | 511 commits to main since this release

    Added

    • pipeline-bot — a dedicated NON-ADMIN Forgejo machine identity for the CI/CD
      data-plane, so the pipeline legs stop authenticating as the site-admin
      gitea_admin. instances/pipeline-bot.yaml: a ForgejoUser (isAdmin:false), a
      token-issuer Job that basic-auths as the bot and mints a write:repository-only
      PAT (forgejo-pipeline-bot-token), and 18 ForgejoCollaborator CRs granting the
      bot write on every pipeline repo (the sean/* repos are user-owned, so a team
      can't reach them — direct collaborator is the only way). The forgejo-creds-reader
      Role resourceNames is extended so the token fans into workflows-{tenant} like the
      admin token. Additive: nothing consumes the bot token until the data-plane legs are
      swapped. Requires forgejo-operator >= v0.6.9 (ForgejoUser + ForgejoCollaborator).

    Included changes (v0.1.1 -> v0.1.2)

    • 2ac7fd101bc8 feat(pipeline-bot): provision dedicated non-admin CI/CD identity
    Downloads
  • v0.1.1 9e2ace3ca4

    v0.1.1 Stable

    gitea_admin released this 2026-07-06 22:54:07 +00:00 | 516 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.1.0 -> v0.1.1)

    • 52f77bf614cd chore(forgejo-operator): deploy v0.6.9 (ForgejoTagProtection + ForgejoCollaborator)
    Downloads
  • v0.1.0 404b1fcc8d

    v0.1.0 Stable

    gitea_admin released this 2026-07-06 15:45:15 +00:00 | 521 commits to main since this release

    • Adopt semver + this changelog: seanfarm/platform-seanfarm now follow the standard
      build → release → deploy shape (release cuts a tag + ff main; deploy fires on the main push),
      instead of deploying directly on every trunk push. See sean/pipelines gitops-flux.
    Downloads