Skip to content

[release] Bump to 0.179.47 — deploy Woodpecker CI (ci.0mpc.com)#13

Merged
baditaflorin merged 5 commits into
mainfrom
claude/affectionate-mcnulty-8c6bd3
May 21, 2026
Merged

[release] Bump to 0.179.47 — deploy Woodpecker CI (ci.0mpc.com)#13
baditaflorin merged 5 commits into
mainfrom
claude/affectionate-mcnulty-8c6bd3

Conversation

@baditaflorin
Copy link
Copy Markdown
Owner

@baditaflorin baditaflorin commented May 20, 2026

Summary

  • Deploy Woodpecker CI at `ci.0mpc.com`: server + agent on docker-runtime, PostgreSQL backend on postgres-lv3, HTTPS via nginx edge
  • Fix `woodpecker_runtime` OpenBao integration: set `common_openbao_compose_env_openbao_address` to point at the platform-wide OpenBao on runtime-control-lv3 and disable local-runtime recovery — matching the `minio_runtime`/`livekit_runtime` pattern
  • Add Gitea API port (3003) to Proxmox VM-level firewall for docker-runtime-lv3 → runtime-control-lv3; this was the root blocker causing 48-retry exhaustion on the Woodpecker OAuth wait task
  • Simplify `woodpecker_runtime/tasks/verify.yml` health check
  • Bootstrap Gitea OAuth app and seed repo `ops/proxmox_florin_server` with CI secret `LV3_WOODPECKER_SECRET_SMOKE`
  • Remove stale neko_instances config from platform.yml and update TLS cert inventory

Release checklist

  • VERSION bumped (0.179.46 → 0.179.47)
  • changelog.md updated
  • Release notes generated
  • Platform manifest regenerated
  • Discovery artifacts regenerated

Test plan

  • `make converge-woodpecker env=production` exits 0 with 0 failures across all hosts
  • `https://ci.0mpc.com/healthz\` → HTTP 204
  • `woodpecker_tool.py whoami` → `ops-gitea` admin authenticated
  • `woodpecker_tool.py list-secrets --repo ops/proxmox_florin_server` → `LV3_WOODPECKER_SECRET_SMOKE` present

🤖 Generated with Claude Code

baditaflorin and others added 5 commits May 20, 2026 21:33
Update live_apply_evidence receipts for glitchtip, outline, and excalidraw
to reflect successful 2026-05-20 deployments. Bump repo_version and
platform_version to 0.179.46.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…utline_runtime to use hex filter

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… vhost

inventory/hosts.yml: fix ansible_host IPs that were offset by 10 for 12
VMs (docker-build, backup, coolify, coolify-apps, artifact-cache,
runtime-ai, runtime-general, postgres-replica, postgres-apps, postgres-data,
runtime-comms, runtime-apps). All now match actual Proxmox cloud-init values.

nginx_edge_publication: add database.0mpc.com as an authenticated proxy
to Adminer running on runtime-general-lv3:8082. Adminer deployed manually
(docker run adminer:4.8.1) with ADMINER_DEFAULT_SERVER=10.10.10.50.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- nginx-site-neko.conf.j2: fix hostvars lookup (runtime-comms → runtime-comms-lv3)
  and use public_edge_effective_cert_name for wildcard cert path instead of
  per-domain cert that does not exist
- inventory/group_vars/platform.yml: add neko_instances.operator entry for
  operator@0mpc.com on port 8080 (provisioned via neko_tool.py)
- inventory/host_vars/proxmox-host.yml: allow docker-runtime-lv3 (10.10.10.20)
  to reach OpenBao at runtime-control-lv3:8201 so plausible and other services
  on docker-runtime can fetch secrets at startup
- playbooks/vars/plausible.yml: skip local-OpenBao probe since plausible runs
  on docker-runtime, not runtime-control; OpenBao is reached remotely

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix woodpecker_runtime OpenBao integration: point compose-env helper at
  remote OpenBao on runtime-control-lv3 (not localhost) by adding
  common_openbao_compose_env_openbao_address and setting
  common_openbao_compose_env_manage_local_openbao_runtime: false,
  matching the minio_runtime/livekit_runtime pattern for services not
  co-located with the OpenBao server
- Add port 3003 (Gitea API) to the Proxmox VM-level firewall inbound rule
  for docker-runtime-lv3 → runtime-control-lv3; without this the
  Woodpecker OAuth bootstrap wait task timed out after 48 retries
- Simplify woodpecker_runtime verify.yml health check to use uri directly
- Woodpecker public endpoint ci.0mpc.com confirmed live (HTTP 204/healthz)
  with Gitea OAuth bootstrap and seed repo secret applied

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@baditaflorin baditaflorin changed the title fix(infrastructure): correct VM host IPs and add database.0mpc.com vhost [release] Bump to 0.179.47 — deploy Woodpecker CI (ci.0mpc.com) May 21, 2026
@baditaflorin baditaflorin merged commit c3d3f9b into main May 21, 2026
0 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant