sean/seanfarm
Watch
1
0
Fork
You've already forked seanfarm
 0
Code Issues Pull requests Projects Releases 386 Packages Wiki Activity

Promote f9d1f1760e to main #773

Merged
binjovi-bot merged 1 commit from trunk into main 2026-09-14 21:41:40 +00:00
Conversation 0 Commits 1 Files changed 15 +65 -283
binjovi-bot commented 2026-09-14 21:41:39 +00:00
Collaborator
Copy link
No description provided.
feat(flux): read the cluster's GitOps state from the chain, not Codeberg
All checks were successful
binjovi/ci Binjovi completed the frozen plan
Details
f9d1f1760e
 
Flux, the Forgejo seed and the recovery job all read Codeberg. They now read
the first off-cluster tier of the chain, code.packet.town, a public
push-mirror copy of every sean/* repository that binjovi configures and a
rebuild cannot destroy. Nothing on the cluster writes there.

  - GitRepository flux-system (both gotk-sync.yaml copies) and
    platform-seanfarm: url -> https://code.packet.town/sean/<repo>.git, no
    secretRef. Forgejo main is the deploy pointer; binjovi's deployer waits
    for the copy to show the released revision and Flux fetches it.
  - openbao-operator-source (tag v0.12.32) and forgejo-operator resource
    source (tag v0.6.36): the same copies carry every tag; no secretRef.
  - forgejo-users/repository-bootstrap.sh seeds a repository with a source
    by migrating from the copy, credential-free; the codeberg-token volume
    and the auth fields in the migrate payload are gone.
  - forgejo-app/mirror-recovery.yaml recovers a gitea-typed importSource from
    the copy instead of Codeberg and passes no credential to the inner git.
    The codeberg-token ExternalSecret in namespace forgejo goes with it.
  - flux-webhook: the four Codeberg Receivers are removed. Nothing on
    Codeberg calls us any more; binjovi requests every reconcile it needs and
    the sources keep their interval.
  - argocd: the two Codeberg repo-creds ExternalSecrets are removed. Every
    Application sources code.sean.farm.
  - scripts/flux-bootstrap.sh installs Flux read-only: `flux install` plus the
    GitRepository and Kustomization against the copy, credential-free.
    `flux bootstrap git` would have committed into the copy. CODEBERG_TOKEN is
    optional and only feeds the codeberg-token secret the retiring Codeberg
    mirrors still push with.

Codeberg is now neither backup nor delivery source. It still holds container
images and packages the cluster pulls (crossplane, pipeline-tools v8,
zfs-exporter, the forgejo-operator image, the tester images) and receives the
43 push mirrors; those are the next two retirements.

Claude-Session: https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/seanfarm!773
No description provided.