Erich Blume
379bcb98af
## Summary - Replace the old pre-Mikado plan doc (`docs/how-to/plans/harden-zot-registry.md`) with a proper C2 Mikado chain in `docs/how-to/zot/` - Root goal: `harden-zot-registry` — enable OIDC + API key auth on zot with anonymous pull preserved - Three leaf prereqs: `register-zot-oidc-client`, `wire-ci-registry-auth`, `enforce-tag-immutability` - Add Zot section to `how-to.md` index, remove plan entry from plans index - All doc checks pass (`docs-check-links`, `docs-check-index`, `docs-mikado`) ## Changes - **New:** `docs/how-to/zot/harden-zot-registry.md` — C2 Mikado root goal - **New:** `docs/how-to/zot/register-zot-oidc-client.md` — Register OIDC client in Authentik - **New:** `docs/how-to/zot/wire-ci-registry-auth.md` — Wire CI push paths with registry auth - **New:** `docs/how-to/zot/enforce-tag-immutability.md` — Prevent version tag overwrites - **Deleted:** `docs/how-to/plans/harden-zot-registry.md` — Old plan doc (content absorbed into Mikado cards) - **Updated:** `docs/how-to/how-to.md` — Add Zot section, remove plan entry - **Updated:** `docs/how-to/plans/plans.md` — Remove plan entry 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/229
1.4 KiB
1.4 KiB
| title | modified | tags | ||
|---|---|---|---|---|
| Plans | 2026-02-20 |
|
Plans
Migration and transition plans for upcoming infrastructure changes. Each plan is a how-to document that captures the full context, steps, and verification criteria for a future execution session.
Plans differ from regular how-to guides in that they describe work that has been designed but not yet executed. Once a plan is completed, it moves to completed.
| Plan | Status | Description |
|---|---|---|
| migrate-forgejo-from-brew | Planned | Transition Forgejo from Homebrew to source-built binary with LaunchAgent |
| add-unifi-pulumi-stack | Abandoned | Add Pulumi IaC for UniFi Express 7 (provider bugs — see doc) |
| upstream-fork-strategy | Planned | Stacked-branch forking strategy for tracking upstream projects |
| adopt-oidc-provider | Completed | Deploy OIDC identity provider for SSO across services |
| forgejo-actions-dashboard | Planned | Grafana dashboard and custom Prometheus exporter for Forgejo Actions CI metrics |
| upgrade-grafana-helm-chart | Planned | Upgrade Grafana Helm chart from 8.8.2 to 11.x (3 phases) |
| deploy-authentik | Active (C2) | Deploy Authentik IdP — Mikado chain tracked in how-to/authentik/ |
| operationalize-reolink-camera | Planned | Cloud-free NVR with Frigate, object detection, and ring buffer recording to sifaka |