Erich Blume
84338c32c2
## Summary - **mirror-create**: Auto-includes GitHub PAT from 1Password for authenticated upstream fetches at mirror creation time - **mirror-update-pats**: New mise task that SSHes into indri and rewrites the git remote URL in every GitHub mirror's bare repo config to embed the PAT. Idempotent, supports `--dry-run` - **app.ini.j2**: Explicit `[mirror]` section with `DEFAULT_INTERVAL = 8h` and `MIN_INTERVAL = 10m` (bakes in the defaults for visibility) - **manage-forgejo-mirrors**: New how-to doc covering mirror creation, PAT storage, the `mirror-update-pats` task, and the full 20-day PAT rotation procedure ## Context GitHub tightened unauthenticated rate limits for git clone/fetch in May 2025. With 23 GitHub mirrors syncing every 8 hours, authenticated fetches avoid throttling. The PAT is stored in 1Password (`Forgejo Secrets` → `github-mirror-pat`) and has been applied to all existing mirrors. ## Deployment and Testing - [x] `mirror-update-pats` dry-run verified (23 mirrors detected) - [x] `mirror-update-pats` applied to all 23 GitHub mirrors on indri - [x] Idempotency confirmed (re-run shows 0 updated, 23 skipped) - [ ] Provision indri with `--tags forgejo` to apply `[mirror]` config - [ ] Trigger a manual mirror sync and verify success in Forgejo UI Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/269
92 lines
3.4 KiB
Markdown
92 lines
3.4 KiB
Markdown
---
|
|
title: Mise Tasks
|
|
modified: 2026-02-24
|
|
tags:
|
|
- reference
|
|
- tools
|
|
- mise
|
|
---
|
|
|
|
# Mise Tasks
|
|
|
|
Operational tasks for BlumeOps, run via `mise run <task>`. Tasks live in `mise-tasks/` and use `#USAGE` directives for argument parsing.
|
|
|
|
Run `mise tasks --sort name` for the live list with descriptions.
|
|
|
|
## AI & Documentation
|
|
|
|
| Task | Description |
|
|
|------|-------------|
|
|
| `ai-docs` | Prime AI context with key documentation |
|
|
| `docs-check-filenames` | Detect duplicate filenames in documentation |
|
|
| `docs-check-frontmatter` | Check required frontmatter fields |
|
|
| `docs-check-index` | Check every doc is referenced in its category index |
|
|
| `docs-check-links` | Validate wiki-links point to existing filenames |
|
|
| `docs-mikado` | View active Mikado dependency chains (C2 changes) |
|
|
| `docs-review` | Review the most stale doc by `last-reviewed` date |
|
|
| `docs-review-stale` | Report docs by last-modified date |
|
|
| `docs-review-tags` | Print frontmatter tag inventory |
|
|
|
|
## Deployment & Provisioning
|
|
|
|
| Task | Description |
|
|
|------|-------------|
|
|
| `provision-indri` | Run Ansible playbook for [[indri]] |
|
|
| `provision-ringtail` | Run Ansible playbook for [[ringtail]] (NixOS) |
|
|
| `provision-sifaka` | Run Ansible playbook for [[sifaka]] |
|
|
| `fly-deploy` | Deploy Fly.io public proxy |
|
|
| `fly-setup` | One-time Fly.io secrets and certs setup |
|
|
| `fly-shutoff` | Emergency shutoff: stop all Fly.io proxy machines |
|
|
| `dns-preview` | Preview DNS changes with [[pulumi]] |
|
|
| `dns-up` | Apply DNS changes with [[pulumi]] |
|
|
| `tailnet-preview` | Preview Tailscale ACL changes with [[pulumi]] |
|
|
| `tailnet-up` | Apply Tailscale ACL changes with [[pulumi]] |
|
|
|
|
## Containers & Registry
|
|
|
|
| Task | Description |
|
|
|------|-------------|
|
|
| `container-list` | List containers and their recent tags |
|
|
| `container-build-and-release` | Trigger container build workflows via Forgejo API |
|
|
| `container-version-check` | Validate version consistency across Dockerfiles, nix, and manifests |
|
|
| `mirror-create` | Create an upstream mirror in the `mirrors/` Forgejo org |
|
|
| `mirror-update-pats` | Update GitHub PAT on all mirror repos on indri |
|
|
|
|
## Git & Forge
|
|
|
|
| Task | Description |
|
|
|------|-------------|
|
|
| `branch-cleanup` | Delete merged branches (local and remote) |
|
|
| `pr-comments` | List unresolved PR comments |
|
|
| `runner-logs` | View Forgejo Actions workflow logs |
|
|
| `validate-workflows` | Validate workflow files against runner schema |
|
|
| `mikado-branch-invariant-check` | Validate Mikado Branch Invariant on `mikado/*` branches |
|
|
|
|
## Operations & Monitoring
|
|
|
|
| Task | Description |
|
|
|------|-------------|
|
|
| `services-check` | Check all services are online and responding |
|
|
| `service-review` | Review the most stale service for version freshness |
|
|
| `blumeops-tasks` | List tasks from Todoist sorted by priority |
|
|
| `op-backup` | Encrypt 1Password export and send to indri for borgmatic |
|
|
|
|
## Infrastructure Setup
|
|
|
|
| Task | Description |
|
|
|------|-------------|
|
|
| `ensure-minikube-indri-kubectl-config` | Set up kubectl config for minikube-indri |
|
|
| `ensure-k3s-ringtail-kubectl-config` | Set up kubectl config for k3s-ringtail |
|
|
|
|
## ML & Hardware
|
|
|
|
| Task | Description |
|
|
|------|-------------|
|
|
| `frigate-export-model` | Export YOLOv9 model weights to ONNX via [[dagger]] |
|
|
|
|
## Related
|
|
|
|
- [[dagger]] — CI/CD build engine (containers, docs)
|
|
- [[ansible]] — Configuration management
|
|
- [[argocd-cli]] — ArgoCD deployment workflows
|
|
- [[pulumi]] — DNS and Tailscale IaC
|