olsitec/foundation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(bootstrap): forgejo admin + org + repo + operator key (T09)

Browse source 
bootstrapForgejo (idempotent, docker-exec — ADR-007) creates the headless admin
via `forgejo admin user create` (run as the git user; no web installer, no default
credentials — PLAN-002 §9.3), then via the image's own curl against the API: the
olsitec org, an auto-init'd olsitec/foundation repo, and the operator's SSH public
key. credentials.ts gains the forgejo admin slice (@pulumi/random) and
writeCredentialsToVault now also writes foundation/forgejo/service-credentials.

Live on cx33 Helsinki: admin + org + repo + key created. GOAL MET —
`git clone git@git.olsitec.net:olsitec/foundation.git` (scp-form, :22) and
`ssh://git@git.olsitec.net:2222/olsitec/foundation.git` both clone the repo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Andreas Niemann 2026-06-30 22:31:13 +02:00
parent f1e1d6facd
commit 3a297d021e
3 changed files with 134 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

23
bootstrap/index.ts
View file

@ -5,6 +5,7 @@
// edges, NOT imperative sequencing, so `pulumi up` derives the order. Wave-2+ tasks
// fill the marked slots — this file is the single composition point; components stay
// pure factories in components/*.
import * as pulumi from "@pulumi/pulumi";
import { loadConfig } from "./config";
import { buildBaseContext, DeployCtx } from "./lib/context";
import { deployNetwork } from "./components/network";
@ -17,7 +18,8 @@ import { deployPostgres } from "./components/postgres";
import { deployRustfs } from "./components/rustfs";
import { deployVault } from "./components/vault";
import { deployProxy } from "./components/proxy";
import { deployForgejo } from "./components/forgejo";
import { deployForgejo, bootstrapForgejo } from "./components/forgejo";
import * as fs from "fs";
const cfg = loadConfig();
@ -55,7 +57,19 @@ const forgejo = deployForgejo(ctx, {
pgCreds: credentials.postgres,
rustfsCreds: credentials.rustfs,
});
// --- GATE B: Forgejo healthy → handover (T11) + runner registration (T10).
// --- GATE B: Forgejo healthy → headless admin + org + repo + operator SSH key
// (T09) so `git clone git@git.olsitec.net:olsitec/...` works. The operator
// public key is the .pub beside SSH_PRIVATE_KEY_PATH (CONTRACT_001 §1).
const sshPublicKey = fs.readFileSync(`${base.sshKeyPath}.pub`, "utf8").trim();
const forgejoBootstrap = bootstrapForgejo(ctx, {
forgejo,
adminCreds: credentials.forgejo,
acmeEmail: cfg.tls.acmeEmail,
orgName: cfg.forgejo.orgName,
repoName: "foundation",
sshPublicKey,
});
// const runner = deployRunner(ctx, { forgejo, credentials });
// =============================================================================
@ -63,10 +77,11 @@ const forgejo = deployForgejo(ctx, {
// vaultCreds (T06) is a gate for Forgejo (T08) — it has no output to export yet.
void vaultCreds;
export const phase = "T08-forgejo"; // forge live (postgres + rustfs + caddy + ssh)
export const phase = "T09-forge-bootstrap"; // admin + org + repo + operator key
export const caddyImageId = proxy.imageId;
export const forgejoEndpoint = forgejo.endpoint;
void forgejo.ready; // GATE B for T09/T10
export const cloneUrl = pulumi.interpolate`git@${cfg.hosts.git}:${cfg.forgejo.orgName}/foundation.git`;
void forgejoBootstrap; // GATE B consumer; no secret output to export
export const networkName = network.name;
export const vmTarget = `${cfg.vm.user}@${cfg.vm.host}`;
export const postgresEndpoint = postgres.endpoint;