42 lines
2.5 KiB
Markdown
42 lines
2.5 KiB
Markdown
## Commands
|
|
|
|
- `cicd-tool repo init` is a legacy GitHub workflow and is not used for new Forgejo/GitOps platform onboarding.
|
|
- `cicd-tool bootstrap` runs a shorter Forgejo-first wizard, asks for a Forgejo PAT, asks where local repos should be cloned, discovers Proxmox nodes/storage/networks, retries without losing entered answers when discovery fails, shows the latest Talos version, derives the standardized Talos factory URL, schematic, and required extensions automatically from the chosen version, writes `terraform.tfvars`, stages Talos images on Proxmox, and can execute Terraform, Talos bootstrap, and Flux bootstrap
|
|
- `cicd-tool bootstrap --config maidn-bootstrap.yaml` skips the wizard and uses the saved config
|
|
- `cicd-tool bootstrap init --config <private-config> --organization <new-org> --create-organization` locks an isolated workspace, initializes Forgejo repositories, then runs the non-destructive bootstrap reconcile lifecycle. Use `--mode=rebuild --yes` only for an authorized rebuild.
|
|
- `cicd-tool app onboard --config <private-config> --from <app-checkout>` is being migrated to central delivery ownership. Do not use the source-owned implementation for new applications; see `docs/architecture/delivery-ownership.md`.
|
|
- `cicd-tool e2e` runs bounded, read-only Flux, ExternalSecret, PipelineRun, preview, and promotion-PR checks with JSON output. See `docs/e2e.md`.
|
|
|
|
See `docs/operations.md` for the authorized operating and verification runbook.
|
|
See `docs/architecture/delivery-ownership.md` for the developer and platform
|
|
ownership boundary.
|
|
App authors: see `docs/delivery-feedback.md` for preview feedback and the scoped Forgejo token contract.
|
|
|
|
## Forgejo setup
|
|
|
|
For `https://git.pingu.pw` you need:
|
|
|
|
- a user token with repo create/push rights
|
|
- an owner target (`Maidn` org by default, or your own user/org)
|
|
- git/ssh access from the machine running the CLI if you want SSH later
|
|
- Flux bootstrap credentials for the repo URL that gets created
|
|
|
|
## Cilium traffic network
|
|
|
|
Every Talos node needs a second static network for Cilium L2 announcements. It has no gateway; the primary network remains the default route. Configure the matching VLAN and a unique MAC address for each node:
|
|
|
|
```yaml
|
|
cilium:
|
|
trafficInterface: eth1
|
|
loadBalancerStart: <first-reserved-address>
|
|
loadBalancerEnd: <last-reserved-address>
|
|
talos:
|
|
nodes:
|
|
- networks:
|
|
- # Primary management network
|
|
- macAddress: <unique-mac>
|
|
cidr: <traffic-subnet>
|
|
ip: <node-traffic-address>
|
|
vlanId: <opnsense-traffic-vlan>
|
|
```
|