2 commits

Author	SHA1	Message	Date
Erich Blume	cd578144f7	Migrate upstream mirrors to mirrors/ Forgejo org (#265) ... ## Summary - Created `mirrors` Forgejo organization for upstream mirror repos - Transferred 22 mirror repos from `eblume/` to `mirrors/` (mirror sync config preserved) - Deleted unused repos: hajimari, hister - Updated all container build URLs (homepage, navidrome, ntfy Dockerfiles + nix) - Updated documentation references (migrate-forgejo-from-brew, upstream-fork-strategy, fix-ntfy-nix-version) - `dotfiles` intentionally kept under `eblume/` per user request - `devpi` transferred to `mirrors/` Repos remaining under `eblume/`: blumeops, cv, mcquack, dotfiles ## Cleanup TODO - [ ] Delete temp Forgejo API token "claude-migration-temp" (Settings > Applications) ## Test Plan - [x] Verified mirror config (mirror=true, original_url) survived transfer on test repo (tesla_auth) - [x] All pre-commit hooks pass (including container-version-check, docs-check-links) - [ ] Verify a mirror repo sync runs successfully after transfer (check mirrors/authentik or similar) - [ ] Rebuild containers from branch to verify Dockerfile URLs resolve Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/265	2026-02-24 20:43:14 -08:00
Erich Blume	0e2c10176d	Harden zot registry, pt 1 (#231) ... ## Summary - Enable OIDC + API key authentication on zot with anonymous pull preserved - Enforce tag immutability for version tags - Adopt commit-SHA-based container image tagging Details in the [[harden-zot-registry]] Mikado chain (`mise run docs-mikado harden-zot-registry`). ## Test plan - [ ] Anonymous pull still works - [ ] Unauthenticated push fails (401) - [ ] CI container builds pass with new auth and tagging - [ ] `mise run services-check` passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/231	2026-02-20 22:50:01 -08:00