From 1c939dccb833754026cfb0e579ff4497438ef805 Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Wed, 9 Sep 2026 17:40:15 +0000 Subject: [PATCH] fix(identity): declare Gitea admin group --- CHANGELOG.md | 1 + infrastructure/samba-ad/ansible/group_vars/all/vars.yml | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7a4d612..e4163f6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -27,6 +27,7 @@ What changed in this homelab, when, and why. Newest first. | Terraform | Recorded Gitea 1.27 State Registry as the preferred candidate for local roots after version and recovery testing; the OCI recovery root remains in OCI Object Storage to avoid a home-control-plane dependency loop | | cleanup | Removed the retired NapCat tree, the Contour and Kanidm archive trees, and seven generated Terraform plan files before establishing the clean Git baseline; plans may embed complete state and remain globally ignored | | CI | Added a review-first Gitea Actions runner bootstrap: official actions chart 0.1.1, pinned runner 2.3.0, one persistent Kubernetes runner with capacity four and rootless DinD, plus an ESO reference to a repository-scoped registration token in OpenBao. It is not deployed until the PR is merged | +| identity | Declared the Samba AD `gitea-admins` group with `panxiao81` as its initial member. Gitea already maps this OIDC group to site administrators; the local `gitea_admin` account remains as break-glass access | `Carried forward`: re-verify OpenBao/ESO recovery and remaining Secret inventory; configure a Git remote and off-site mirror; confirm the running Gitea version; diff --git a/infrastructure/samba-ad/ansible/group_vars/all/vars.yml b/infrastructure/samba-ad/ansible/group_vars/all/vars.yml index 14ca387..6756733 100644 --- a/infrastructure/samba-ad/ansible/group_vars/all/vars.yml +++ b/infrastructure/samba-ad/ansible/group_vars/all/vars.yml @@ -69,6 +69,11 @@ samba_ad_groups: - name: pve-admins members: [panxiao81] + # Gitea maps this OIDC group to site administrators through oauth2.adminGroup. + # Keep at least one human administrator independent of the local break-glass account. + - name: gitea-admins + members: [panxiao81] + # NetBox: Authelia forward-auth restricts the site to this group, and NetBox maps it # to is_superuser + is_staff via REMOTE_AUTH_SUPERUSER_GROUPS / STAFF_GROUPS # (../../../apps/netbox). Membership is re-evaluated on every request, so removing someone