feat(forge): normalize the off-cluster Forgejo chain to code.packet.town -> code.kri.pt #762

Merged

binjovi-bot merged 1 commit from feat/forge-chain-normalize into trunk

2026-09-14 18:06:24 +00:00

sean commented

2026-09-14 18:00:18 +00:00

Owner

What

Normalizes the off-cluster Forgejo chain: same product, same release (16.0.4), same hostname shape on all three tiers, every push mirror configured by Binjovi.

code.sean.farm (k8s) -> code.packet.town (FreeBSD jail) -> code.kri.pt (OmniOS zone, hourly ZFS snapshots the zone cannot touch)

scripts/forgejo-build.sh — shared offline source build (the tarball carries frontend + vendor/), version asserted. One illumos port patch (scripts/forgejo-patches/zoekt-illumos.patch), applied only on SunOS; the code indexer is disabled on both tiers.
scripts/freebsd/forge-jail.sh — fresh 16.0.4 instance replacing pkg 15.0.7; live hostname rename; certificate re-issued on CA or CN change; mints the mirror-bot token. Never touches /etc/pf.conf.
scripts/omnios/forge-zone.sh — new lipkg zone, etherstub, no default route; /var/forgejo lofs-mounted from GZ dataset rpool/forge/data; nginx + acme.sh in the GZ; SMF for Forgejo and PostgreSQL. Never touches /etc/ipf/*.
Guards tests/forge-packet-town.sh, tests/forge-kri-pt.sh (make targets); scripts/forge-restore-drill.sh.
forge-creds: ClusterSecretStores packettown-creds and kript-creds scoped to namespace binjovi, fed by SOPS secrets/{packettown,kript}-token.yaml.enc through make forge-tokens-setup.
Deletes the old jail/archive scripts, guards and READMEs; scripts/README-FORGE-CHAIN.md replaces both.

Why the stores matter now

binjovi PR #1786 (released v0.1.740) mounts ExternalSecrets binjovi-packettown / binjovi-kript from these stores. Its production sync failed on exactly those two resources (could not get secret data from provider) because the stores are not on trunk yet. This PR is the missing half.

Trust widening, stated

Binjovi configures hop 2 from the cluster, so the cluster holds a repo-admin token for packet.town. This is acceptable because the kri.pt snapshots are owned by its global zone and reachable by no Forgejo credential anywhere.

Verified

bash tests/check.sh -> CHECK EXIT=0
make test-forge-packet-town and make test-forge-kri-pt pass against the live hosts (both report 16.0.4, LE production certificates, org sean, valid mirror-bot tokens).
Both converge scripts ran twice; the second run changed nothing.
Cutover done: rpool/archive and the GZ git user destroyed on OmniOS; DNS git.kri.pt and archive.packet.town removed.

https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6

## What Normalizes the off-cluster Forgejo chain: same product, same release (16.0.4), same hostname shape on all three tiers, every push mirror configured by Binjovi. ``` code.sean.farm (k8s) -> code.packet.town (FreeBSD jail) -> code.kri.pt (OmniOS zone, hourly ZFS snapshots the zone cannot touch) ``` - `scripts/forgejo-build.sh` — shared offline source build (the tarball carries frontend + vendor/), version asserted. One illumos port patch (`scripts/forgejo-patches/zoekt-illumos.patch`), applied only on SunOS; the code indexer is disabled on both tiers. - `scripts/freebsd/forge-jail.sh` — fresh 16.0.4 instance replacing pkg 15.0.7; live hostname rename; certificate re-issued on CA **or** CN change; mints the `mirror-bot` token. Never touches `/etc/pf.conf`. - `scripts/omnios/forge-zone.sh` — new lipkg zone, etherstub, no default route; `/var/forgejo` lofs-mounted from GZ dataset `rpool/forge/data`; nginx + acme.sh in the GZ; SMF for Forgejo and PostgreSQL. Never touches `/etc/ipf/*`. - Guards `tests/forge-packet-town.sh`, `tests/forge-kri-pt.sh` (make targets); `scripts/forge-restore-drill.sh`. - `forge-creds`: ClusterSecretStores `packettown-creds` and `kript-creds` scoped to namespace `binjovi`, fed by SOPS `secrets/{packettown,kript}-token.yaml.enc` through `make forge-tokens-setup`. - Deletes the old jail/archive scripts, guards and READMEs; `scripts/README-FORGE-CHAIN.md` replaces both. ## Why the stores matter now binjovi PR #1786 (released v0.1.740) mounts ExternalSecrets `binjovi-packettown` / `binjovi-kript` from these stores. Its production sync failed on exactly those two resources (`could not get secret data from provider`) because the stores are not on trunk yet. This PR is the missing half. ## Trust widening, stated Binjovi configures hop 2 from the cluster, so the cluster holds a repo-admin token for packet.town. This is acceptable because the kri.pt snapshots are owned by its global zone and reachable by no Forgejo credential anywhere. ## Verified - `bash tests/check.sh` -> `CHECK EXIT=0` - `make test-forge-packet-town` and `make test-forge-kri-pt` pass against the live hosts (both report 16.0.4, LE production certificates, org `sean`, valid mirror-bot tokens). - Both converge scripts ran twice; the second run changed nothing. - Cutover done: `rpool/archive` and the GZ `git` user destroyed on OmniOS; DNS `git.kri.pt` and `archive.packet.town` removed. https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6

sean added 1 commit

2026-09-14 18:00:19 +00:00

feat(forge): normalize the off-cluster Forgejo chain to code.packet.town -> code.kri.pt

binjovi/ci Binjovi completed the frozen plan

Details

9d16be5cfa

The chain is now the same product on all three tiers, on the same release,
under the same hostname shape, fed in series by Binjovi:

    code.sean.farm (k8s) -> code.packet.town (FreeBSD jail) -> code.kri.pt (OmniOS zone)

Before: git.kri.pt ran the FreeBSD pkg Forgejo 15.0.7 and pushed over SSH to a
bare-git archive at archive.packet.town. The domains swap hosts (kri.pt is the
terminal archive), both tiers move to Forgejo 16.0.4, and every push mirror is
configured by Binjovi. No script on a laptop creates a mirror any more.

Why source builds: FreeBSD pkg tops out at 15.0.7 and illumos has no release
binary. The 16.0.4 source tarball carries the built frontend and vendor/, so
scripts/forgejo-build.sh builds offline inside the jail or zone with the host's
go 1.26 and asserts the binary reports the pinned version. illumos needs one
port patch (scripts/forgejo-patches/zoekt-illumos.patch): the vendored zoekt
indexfile is fenced to linux/darwin/freebsd; it builds unchanged with solaris
added, and the code indexer is disabled on both tiers.

scripts/freebsd/forge-jail.sh: fresh instance, not an upgrade. Retires the pkg
Forgejo, builds 16.0.4, moves PostgreSQL to /var/forgejo/postgres/17, renames
the jail hostname live with jail -m, re-issues the certificate when the CA OR
the CN differs and removes the dead git.kri.pt acme.sh entry, mints the
mirror-bot token. Never touches /etc/pf.conf.

scripts/omnios/forge-zone.sh (new): lipkg zone on an etherstub with no default
route, /var/forgejo lofs-mounted from the GZ dataset rpool/forge/data so hourly
snapshots cover repos and Postgres in one atomic step and the zone can neither
see nor delete them. nginx and acme.sh in the GZ; Forgejo, PostgreSQL 17 and git
in the zone under SMF. Never touches /etc/ipf/*.

Guards: tests/forge-packet-town.sh and tests/forge-kri-pt.sh replace the old
pair (node undisturbed, exposure, version, TLS issuer, snapshots, canary parity
from the snapshot path). scripts/forge-restore-drill.sh measures delivery
through both Binjovi hops and restores a repo from .zfs/snapshot without
Forgejo.

Credentials: secrets/{packettown,kript}-token.yaml.enc hold the mirror-bot
tokens; make forge-tokens-setup lands them in flux-system; the forge-creds
ClusterSecretStores are scoped to namespace binjovi, where Binjovi's
ExternalSecrets read them.

Trust widening, stated: Binjovi configures hop 2 from the cluster, so the
cluster holds a repo-admin token for packet.town. Acceptable because kri.pt's
snapshots are owned by its global zone and reachable by no Forgejo credential.

Cutover done: rpool/archive and the GZ git user on OmniOS destroyed; DNS
git.kri.pt and archive.packet.town removed.

Claude-Session: https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6