panxiao81/homelab-infra
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(identity): declare Gitea admin group #2

Merged
panxiao81 merged 1 commits from fix/gitea-admin-group into main 2026-09-09 17:41:04 +00:00
Conversation 0 Commits 1 Files Changed 2
+6
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+1
View File
@@ -27,6 +27,7 @@ What changed in this homelab, when, and why. Newest first.
| Terraform | Recorded Gitea 1.27 State Registry as the preferred candidate for local roots after version and recovery testing; the OCI recovery root remains in OCI Object Storage to avoid a home-control-plane dependency loop | | Terraform | Recorded Gitea 1.27 State Registry as the preferred candidate for local roots after version and recovery testing; the OCI recovery root remains in OCI Object Storage to avoid a home-control-plane dependency loop |
| cleanup | Removed the retired NapCat tree, the Contour and Kanidm archive trees, and seven generated Terraform plan files before establishing the clean Git baseline; plans may embed complete state and remain globally ignored | | cleanup | Removed the retired NapCat tree, the Contour and Kanidm archive trees, and seven generated Terraform plan files before establishing the clean Git baseline; plans may embed complete state and remain globally ignored |
| CI | Added a review-first Gitea Actions runner bootstrap: official actions chart 0.1.1, pinned runner 2.3.0, one persistent Kubernetes runner with capacity four and rootless DinD, plus an ESO reference to a repository-scoped registration token in OpenBao. It is not deployed until the PR is merged | | CI | Added a review-first Gitea Actions runner bootstrap: official actions chart 0.1.1, pinned runner 2.3.0, one persistent Kubernetes runner with capacity four and rootless DinD, plus an ESO reference to a repository-scoped registration token in OpenBao. It is not deployed until the PR is merged |
| identity | Declared the Samba AD `gitea-admins` group with `panxiao81` as its initial member. Gitea already maps this OIDC group to site administrators; the local `gitea_admin` account remains as break-glass access |
`Carried forward`: re-verify OpenBao/ESO recovery and remaining Secret inventory; `Carried forward`: re-verify OpenBao/ESO recovery and remaining Secret inventory;
configure a Git remote and off-site mirror; confirm the running Gitea version; configure a Git remote and off-site mirror; confirm the running Gitea version;
infrastructure/samba-ad/ansible/group_vars/all/vars.yml
+5
View File
@@ -69,6 +69,11 @@ samba_ad_groups:
- name: pve-admins - name: pve-admins
members: [panxiao81] members: [panxiao81]
# Gitea maps this OIDC group to site administrators through oauth2.adminGroup.
# Keep at least one human administrator independent of the local break-glass account.
- name: gitea-admins
members: [panxiao81]
# NetBox: Authelia forward-auth restricts the site to this group, and NetBox maps it # NetBox: Authelia forward-auth restricts the site to this group, and NetBox maps it
# to is_superuser + is_staff via REMOTE_AUTH_SUPERUSER_GROUPS / STAFF_GROUPS # to is_superuser + is_staff via REMOTE_AUTH_SUPERUSER_GROUPS / STAFF_GROUPS
# (../../../apps/netbox). Membership is re-evaluated on every request, so removing someone # (../../../apps/netbox). Membership is re-evaluated on every request, so removing someone