Promote 9d16be5cfa to main #763

Merged
binjovi-bot merged 1 commit from trunk into main 2026-09-14 18:06:28 +00:00
Collaborator
No description provided.
feat(forge): normalize the off-cluster Forgejo chain to code.packet.town -> code.kri.pt
All checks were successful
binjovi/ci Binjovi completed the frozen plan
9d16be5cfa
The chain is now the same product on all three tiers, on the same release,
under the same hostname shape, fed in series by Binjovi:

    code.sean.farm (k8s) -> code.packet.town (FreeBSD jail) -> code.kri.pt (OmniOS zone)

Before: git.kri.pt ran the FreeBSD pkg Forgejo 15.0.7 and pushed over SSH to a
bare-git archive at archive.packet.town. The domains swap hosts (kri.pt is the
terminal archive), both tiers move to Forgejo 16.0.4, and every push mirror is
configured by Binjovi. No script on a laptop creates a mirror any more.

Why source builds: FreeBSD pkg tops out at 15.0.7 and illumos has no release
binary. The 16.0.4 source tarball carries the built frontend and vendor/, so
scripts/forgejo-build.sh builds offline inside the jail or zone with the host's
go 1.26 and asserts the binary reports the pinned version. illumos needs one
port patch (scripts/forgejo-patches/zoekt-illumos.patch): the vendored zoekt
indexfile is fenced to linux/darwin/freebsd; it builds unchanged with solaris
added, and the code indexer is disabled on both tiers.

scripts/freebsd/forge-jail.sh: fresh instance, not an upgrade. Retires the pkg
Forgejo, builds 16.0.4, moves PostgreSQL to /var/forgejo/postgres/17, renames
the jail hostname live with jail -m, re-issues the certificate when the CA OR
the CN differs and removes the dead git.kri.pt acme.sh entry, mints the
mirror-bot token. Never touches /etc/pf.conf.

scripts/omnios/forge-zone.sh (new): lipkg zone on an etherstub with no default
route, /var/forgejo lofs-mounted from the GZ dataset rpool/forge/data so hourly
snapshots cover repos and Postgres in one atomic step and the zone can neither
see nor delete them. nginx and acme.sh in the GZ; Forgejo, PostgreSQL 17 and git
in the zone under SMF. Never touches /etc/ipf/*.

Guards: tests/forge-packet-town.sh and tests/forge-kri-pt.sh replace the old
pair (node undisturbed, exposure, version, TLS issuer, snapshots, canary parity
from the snapshot path). scripts/forge-restore-drill.sh measures delivery
through both Binjovi hops and restores a repo from .zfs/snapshot without
Forgejo.

Credentials: secrets/{packettown,kript}-token.yaml.enc hold the mirror-bot
tokens; make forge-tokens-setup lands them in flux-system; the forge-creds
ClusterSecretStores are scoped to namespace binjovi, where Binjovi's
ExternalSecrets read them.

Trust widening, stated: Binjovi configures hop 2 from the cluster, so the
cluster holds a repo-admin token for packet.town. Acceptable because kri.pt's
snapshots are owned by its global zone and reachable by no Forgejo credential.

Cutover done: rpool/archive and the GZ git user on OmniOS destroyed; DNS
git.kri.pt and archive.packet.town removed.

Claude-Session: https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/seanfarm!763
No description provided.