Erich Blume 84338c32c2 Add authenticated GitHub PAT for Forgejo mirror sync (#269 )

## Summary

- **mirror-create**: Auto-includes GitHub PAT from 1Password for authenticated upstream fetches at mirror creation time
- **mirror-update-pats**: New mise task that SSHes into indri and rewrites the git remote URL in every GitHub mirror's bare repo config to embed the PAT. Idempotent, supports `--dry-run`
- **app.ini.j2**: Explicit `[mirror]` section with `DEFAULT_INTERVAL = 8h` and `MIN_INTERVAL = 10m` (bakes in the defaults for visibility)
- **manage-forgejo-mirrors**: New how-to doc covering mirror creation, PAT storage, the `mirror-update-pats` task, and the full 20-day PAT rotation procedure

## Context

GitHub tightened unauthenticated rate limits for git clone/fetch in May 2025. With 23 GitHub mirrors syncing every 8 hours, authenticated fetches avoid throttling. The PAT is stored in 1Password (`Forgejo Secrets` → `github-mirror-pat`) and has been applied to all existing mirrors.

## Deployment and Testing

- [x] `mirror-update-pats` dry-run verified (23 mirrors detected)
- [x] `mirror-update-pats` applied to all 23 GitHub mirrors on indri
- [x] Idempotency confirmed (re-run shows 0 updated, 23 skipped)
- [ ] Provision indri with `--tags forgejo` to apply `[mirror]` config
- [ ] Trigger a manual mirror sync and verify success in Forgejo UI

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/269

2026-02-25 20:20:23 -08:00

3.4 KiB

Raw Blame History

title

modified

Mise Tasks

Operational tasks for BlumeOps, run via mise run <task>. Tasks live in mise-tasks/ and use #USAGE directives for argument parsing.

Run mise tasks --sort name for the live list with descriptions.

AI & Documentation

Task	Description
`ai-docs`	Prime AI context with key documentation
`docs-check-filenames`	Detect duplicate filenames in documentation
`docs-check-frontmatter`	Check required frontmatter fields
`docs-check-index`	Check every doc is referenced in its category index
`docs-check-links`	Validate wiki-links point to existing filenames
`docs-mikado`	View active Mikado dependency chains (C2 changes)
`docs-review`	Review the most stale doc by `last-reviewed` date
`docs-review-stale`	Report docs by last-modified date
`docs-review-tags`	Print frontmatter tag inventory

Deployment & Provisioning

Task	Description
`provision-indri`	Run Ansible playbook for indri
`provision-ringtail`	Run Ansible playbook for ringtail (NixOS)
`provision-sifaka`	Run Ansible playbook for sifaka
`fly-deploy`	Deploy Fly.io public proxy
`fly-setup`	One-time Fly.io secrets and certs setup
`fly-shutoff`	Emergency shutoff: stop all Fly.io proxy machines
`dns-preview`	Preview DNS changes with pulumi
`dns-up`	Apply DNS changes with pulumi
`tailnet-preview`	Preview Tailscale ACL changes with pulumi
`tailnet-up`	Apply Tailscale ACL changes with pulumi

Containers & Registry

Task	Description
`container-list`	List containers and their recent tags
`container-build-and-release`	Trigger container build workflows via Forgejo API
`container-version-check`	Validate version consistency across Dockerfiles, nix, and manifests
`mirror-create`	Create an upstream mirror in the `mirrors/` Forgejo org
`mirror-update-pats`	Update GitHub PAT on all mirror repos on indri

Git & Forge

Task	Description
`branch-cleanup`	Delete merged branches (local and remote)
`pr-comments`	List unresolved PR comments
`runner-logs`	View Forgejo Actions workflow logs
`validate-workflows`	Validate workflow files against runner schema
`mikado-branch-invariant-check`	Validate Mikado Branch Invariant on `mikado/*` branches

Operations & Monitoring

Task	Description
`services-check`	Check all services are online and responding
`service-review`	Review the most stale service for version freshness
`blumeops-tasks`	List tasks from Todoist sorted by priority
`op-backup`	Encrypt 1Password export and send to indri for borgmatic

Infrastructure Setup

Task	Description
`ensure-minikube-indri-kubectl-config`	Set up kubectl config for minikube-indri
`ensure-k3s-ringtail-kubectl-config`	Set up kubectl config for k3s-ringtail

ML & Hardware

Task	Description
`frigate-export-model`	Export YOLOv9 model weights to ONNX via dagger

dagger — CI/CD build engine (containers, docs)
ansible — Configuration management
argocd-cli — ArgoCD deployment workflows
pulumi — DNS and Tailscale IaC

3.4 KiB Raw Blame History