3 commits

Author	SHA1	Message	Date
Erich Blume	cd578144f7	Migrate upstream mirrors to mirrors/ Forgejo org (#265) ... ## Summary - Created `mirrors` Forgejo organization for upstream mirror repos - Transferred 22 mirror repos from `eblume/` to `mirrors/` (mirror sync config preserved) - Deleted unused repos: hajimari, hister - Updated all container build URLs (homepage, navidrome, ntfy Dockerfiles + nix) - Updated documentation references (migrate-forgejo-from-brew, upstream-fork-strategy, fix-ntfy-nix-version) - `dotfiles` intentionally kept under `eblume/` per user request - `devpi` transferred to `mirrors/` Repos remaining under `eblume/`: blumeops, cv, mcquack, dotfiles ## Cleanup TODO - [ ] Delete temp Forgejo API token "claude-migration-temp" (Settings > Applications) ## Test Plan - [x] Verified mirror config (mirror=true, original_url) survived transfer on test repo (tesla_auth) - [x] All pre-commit hooks pass (including container-version-check, docs-check-links) - [ ] Verify a mirror repo sync runs successfully after transfer (check mirrors/authentik or similar) - [ ] Rebuild containers from branch to verify Dockerfile URLs resolve Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/265	2026-02-24 20:43:14 -08:00
Erich Blume	0e2c10176d	Harden zot registry, pt 1 (#231) ... ## Summary - Enable OIDC + API key authentication on zot with anonymous pull preserved - Enforce tag immutability for version tags - Adopt commit-SHA-based container image tagging Details in the [[harden-zot-registry]] Mikado chain (`mise run docs-mikado harden-zot-registry`). ## Test plan - [ ] Anonymous pull still works - [ ] Unauthenticated push fails (401) - [ ] CI container builds pass with new auth and tagging - [ ] `mise run services-check` passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/231	2026-02-20 22:50:01 -08:00
Erich Blume	b876e39981	Replace Homepage Helm chart with kustomize manifests and custom Dockerfile (#221) ... ## Summary - Replace third-party Helm chart (jameswynn/homepage v2.1.0, pinned at app v1.2.0) with plain kustomize manifests and a custom Dockerfile building from forge mirror at v1.10.1 - Adds Dockerfile (`containers/homepage/`) with multi-stage build (node:22-slim builder, node:22-alpine runtime) - Creates kustomize manifests: Deployment, Service, ConfigMap (6 config files), ServiceAccount, ClusterRole, ClusterRoleBinding - Keeps existing ingress-tailscale.yaml and all 6 ExternalSecret resources unchanged - Updates ArgoCD app definition from multi-source Helm to single directory source ## Prerequisite - Homepage source mirrored at forge.ops.eblu.me/eblume/homepage.git ✅ - Container must be built and pushed before syncing: `mise run container-release homepage v1.10.1` ## Deployment and Testing - [ ] Build and push container image: `mise run container-release homepage v1.10.1` - [ ] Branch-test via ArgoCD: `argocd app set homepage --revision feature/homepage-kustomize && argocd app sync homepage` - [ ] Verify dashboard loads at go.ops.eblu.me / go.tail8d86e.ts.net - [ ] Verify k8s autodiscovery works (services appear on dashboard) - [ ] Verify widgets load (weather, Forgejo, Jellyfin, etc.) - [ ] After merge: `argocd app set homepage --revision main && argocd app sync homepage` 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/221	2026-02-19 18:29:19 -08:00