Commands

• cicd-tool repo init is a legacy GitHub workflow and is not used for new Forgejo/GitOps platform onboarding.
• cicd-tool bootstrap runs a shorter Forgejo-first wizard, asks for a Forgejo PAT, asks where local repos should be cloned, discovers Proxmox nodes/storage/networks, retries without losing entered answers when discovery fails, shows the latest Talos version, derives the standardized Talos factory URL, schematic, and required extensions automatically from the chosen version, writes terraform.tfvars, stages Talos images on Proxmox, and can execute Terraform, Talos bootstrap, and Flux bootstrap
• cicd-tool bootstrap --config maidn-bootstrap.yaml skips the wizard and uses the saved config
• cicd-tool bootstrap init --config <private-config> --organization <new-org> --create-organization locks an isolated workspace, initializes Forgejo repositories, then runs the non-destructive bootstrap reconcile lifecycle. Use --mode=rebuild --yes only for an authorized rebuild.
• cicd-tool app onboard --config <private-config> --from <app-checkout> is being migrated to central delivery ownership. Do not use the source-owned implementation for new applications; see docs/architecture/delivery-ownership.md.
• cicd-tool e2e runs bounded, read-only Flux, ExternalSecret, PipelineRun, preview, and promotion-PR checks with JSON output. See docs/e2e.md.

See docs/operations.md for the authorized operating and verification runbook. See docs/architecture/delivery-ownership.md for the developer and platform ownership boundary. App authors: see docs/delivery-feedback.md for preview feedback and the scoped Forgejo token contract.

Forgejo setup

For https://git.pingu.pw you need:

• a user token with repo create/push rights
• an owner target (Maidn org by default, or your own user/org)
• git/ssh access from the machine running the CLI if you want SSH later
• Flux bootstrap credentials for the repo URL that gets created

Cilium traffic network

Every Talos node needs a second static network for Cilium L2 announcements. It has no gateway; the primary network remains the default route. Configure the matching VLAN and a unique MAC address for each node:

cilium:
  trafficInterface: eth1
  loadBalancerStart: <first-reserved-address>
  loadBalancerEnd: <last-reserved-address>
talos:
  nodes:
    - networks:
        - # Primary management network
        - macAddress: <unique-mac>
          cidr: <traffic-subnet>
          ip: <node-traffic-address>
          vlanId: <opnsense-traffic-vlan>