Erich Blume b0bac91ca9 Fix frontmatter field name for Quartz date display (#158 )

## Summary

- Rename `date-modified` -> `modified` in all 80 docs and the `docs-check-frontmatter` task

Quartz's `CreatedModifiedDate` plugin recognizes `modified`, `lastmod`, `updated`, and `last-modified` — but not `date-modified`. The wrong field name caused Quartz to ignore frontmatter dates entirely and fall through to filesystem timestamps (UTC inside Dagger), showing Feb 12 on pages built late on Feb 11 PST.

## Test plan

- [x] `mise run docs-check-frontmatter` passes
- [ ] Kick off docs release after merge — verify rendered dates match frontmatter values

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/158

2026-02-11 16:45:12 -08:00

3.3 KiB

Raw Blame History

title

modified

Forgejo

Git forge and CI/CD platform. Primary source of truth for blumeops (mirrored to GitHub).

Quick Reference

Property	Value
URL	https://forge.ops.eblu.me
SSH	`ssh://forgejo@forge.ops.eblu.me:2222`
Local Ports	3001 (HTTP), 2200 (SSH)
Config	`ansible/roles/forgejo/templates/app.ini.j2`

Repositories

Repo	Description
`eblume/blumeops`	Infrastructure as code (primary)
`eblume/alloy`	Grafana Alloy fork (CGO build)
`eblume/tesla_auth`	Tesla OAuth helper
Helm chart mirrors	cloudnative-pg-charts, grafana-helm-charts

CI/CD (Forgejo Actions)

Runner: Kubernetes pod with Docker-in-Docker sidecar

Namespace: forgejo-runner
Labels: k8s
ArgoCD app: forgejo-runner

Workflows: .forgejo/workflows/

build-container.yaml - Container image builds on tag
build-blumeops.yaml - Documentation builds and releases

Secrets (Forgejo Config)

Server configuration secrets managed via 1Password → Ansible:

lfs-jwt-secret, internal-token, oauth2-jwt-secret - Forgejo server tokens
runner_reg - Runner registration token (also in k8s via external-secrets)

Forgejo Actions Secrets

Repository-level secrets for CI/CD workflows, synced from 1Password via Ansible.

Secret	1Password Field	Used By	Purpose
`ARGOCD_AUTH_TOKEN`	`argocd_token`	`build-blumeops.yaml`	Sync docs app after release

These secrets are injected as ${{ secrets.SECRET_NAME }} in workflow files.

IaC: The forgejo_actions_secrets Ansible role syncs these secrets from 1Password to Forgejo via the Forgejo API. Run with:

mise run provision-indri -- --tags forgejo_actions_secrets

API Token Setup (Manual, One-Time)

The Ansible role authenticates to the Forgejo API using a Personal Access Token (PAT). This PAT must be created manually:

Go to https://forge.ops.eblu.me/user/settings/applications
Create a new token with write:repository scope
Store it in 1Password → "Forgejo Secrets" item → api-token field

This is a bootstrapping requirement - the PAT enables IaC for all other secrets.

Future: Public Access

Forgejo can be exposed publicly at forge.eblu.me via flyio-proxy. Since Forgejo runs natively on indri (not in k8s), the pattern is:

Create a k8s ExternalName Service pointing to indri's Tailscale IP
Create a Tailscale Ingress with tailscale.com/tags: "tag:k8s,tag:flyio-target"
Add the nginx server block and DNS CNAME

Exposing a dynamic, authenticated service like Forgejo requires a full security review before going live:

Disable open user registration (require invites or admin approval)
Configure fail2ban on indri with a filter for Forgejo's log format
Ensure Forgejo logs the forwarded client IP (X-Real-IP) rather than the proxy's Tailscale IP
Audit repository visibility defaults and permissions
Rehearse the break-glass shutoff (mise run fly-shutoff)

See expose-service-publicly for the full howto and dynamic service checklist.

argocd - Uses Forgejo as git source
zot - Container registry for built images

3.3 KiB Raw Blame History