multica-nix-packager/infra
1
0
Fork 0
forked from infrastructure/infra
Code Pull requests Activity
No description
218 commits 62 branches 1 tag 7.9 MiB
  • YAML 29.3%
  • MARKDOWN 25.6%
  • JSON 16.2%
  • Nix 15.8%
  • Python 3.6%
  • Other 9.5%
Find a file
Exact
GitOps + 运维 @ Beacoworks f56947ca69
 fix(n8n): watch workflow ConfigMap on deployment
2026-09-26 03:50:27 +08:00
.forgejo feat(gate): restrict agent paths on main 2026-09-26 03:34:50 +08:00
.githooks fix(ci): preserve runner drain and check secret commits 2026-09-13 00:25:58 +08:00
docs feat(gate): restrict agent paths on main 2026-09-26 03:34:50 +08:00
examples chore(history): establish audited public root 2026-09-09 18:30:00 +08:00
hosts feat(agents): isolate GitOps coding identity 2026-09-25 18:37:00 +08:00
kubernetes/flux/cluster chore(history): establish audited public root 2026-09-09 18:30:00 +08:00
lib refactor(paseo): pin v0.9.2 from one shared definition site 2026-09-25 02:46:45 +08:00
modules fix(agents): cap Thor Qwen output in Pi 2026-09-26 01:16:57 +08:00
packages refactor(nchnroutes): extract reusable route package 2026-09-24 05:38:16 +08:00
rules docs(agent): pi agent response truncated debug 2026-09-24 03:23:36 +08:00
secrets chore(history): establish audited public root 2026-09-09 18:30:00 +08:00
taichu docs(taichu): inventory docs 2026-09-24 03:23:37 +08:00
terraform feat(backup): add Wanxiang off-site Longhorn target (#76) 2026-09-17 14:50:44 +00:00
utils feat(gate): restrict agent paths on main 2026-09-26 03:34:50 +08:00
wanxiang fix(n8n): watch workflow ConfigMap on deployment 2026-09-26 03:50:27 +08:00
.gitignore chore(history): establish audited public root 2026-09-09 18:30:00 +08:00
.sops.yaml chore(history): establish audited public root 2026-09-09 18:30:00 +08:00
AGENTS.md docs(i18n): migrate README, AGENTS, and TODO to the bilingual convention 2026-09-24 03:23:37 +08:00
AGENTS_en.md docs(i18n): migrate README, AGENTS, and TODO to the bilingual convention 2026-09-24 03:23:37 +08:00
flake.lock refactor(paseo): pin v0.9.2 from one shared definition site 2026-09-25 02:46:45 +08:00
flake.nix refactor(paseo): pin v0.9.2 from one shared definition site 2026-09-25 02:46:45 +08:00
README.md docs(agentic): consolidate harness and infrastructure operations 2026-09-24 03:23:38 +08:00
README_en.md docs(agentic): consolidate harness and infrastructure operations 2026-09-24 03:23:38 +08:00
renovate.json fix(ci): re-review changed Renovate deltas (#63) 2026-09-17 02:49:05 +00:00
TODO.md docs(i18n): migrate README, AGENTS, and TODO to the bilingual convention 2026-09-24 03:23:37 +08:00
TODO_en.md docs(i18n): migrate README, AGENTS, and TODO to the bilingual convention 2026-09-24 03:23:37 +08:00

README_en.md

中文 | English

Beacoworks infrastructure

This is the public, canonical infrastructure monorepo on Forgejo. GitHub is a one-way showcase mirror of main. Make changes and run CI on Forgejo; GitHub Actions is disabled. Production approval and releases remain in infra-private on Forgejo.

Repository layout

  • flake.nix, hosts/, modules/, packages/, secrets/: public NixOS and nix-darwin fleet configuration.
  • taichu/: Harvester/RKE2 environment inventory.
  • wanxiang/: Talos, Kubernetes, and Flux configuration.
  • kubernetes/flux/: repository-level Flux entrypoint.

The Nix flake stays at the repository root so existing rebuild and Comin flows can change only the repository URL. Existing Attic cache and OCI package names retain the nix-fleet name during migration to avoid breaking consumers.

Public and private boundary

SOPS-encrypted secrets may be committed here. Plaintext credentials, decrypted outputs, kubeconfigs, Talos configs, age keys, and local runtime state may not.

Use the root .sops.yaml for root-level Nix secrets. Run Wanxiang SOPS commands from wanxiang/ or pass --config wanxiang/.sops.yaml explicitly so cluster secrets keep their own recipient set.

Enable the repository's staged-content check in each clone:

git config --local core.hooksPath .githooks

The hook uses Nix to provide Python and PyYAML. It checks staged Git content for private keys, local credential files, and unencrypted protected YAML/JSON values, including Kubernetes Secrets. Supported example and template values are allowed; SOPS metadata alone does not exempt plaintext fields. Diagnostics show file locations without credential values. This is a targeted check, not a general-purpose detector for every token format or proof of valid encryption.

The Check Secrets workflow runs regression tests and scans the checked-out commit on pushes and pull requests. To run the same checks locally:

nix-shell -p python3Packages.pyyaml --run 'python3 utils/test-check-secrets.py'
nix-shell -p python3Packages.pyyaml --run 'python3 utils/check-secrets.py'

The scanner defaults to HEAD; use --staged to check pending staged changes. CI detects committed problems after upload, so it does not replace the local hook or review of recipient changes in .sops.yaml.

Private cloud-host definitions and private edge/proxy topology stay in the separate infrastructure/infra-private repository. It is not a submodule of this repository. Public host baselines may be exported as NixOS modules for a private overlay, but private behavior and its production output are assembled and released only from the private repository.

CI/CD and production delivery

infra/main is the public integration branch. infra-private pins reviewed public revisions and owns production approval, release tags, prod promotion, and Comin rollout. Start with the CI/CD documentation for the complete release flow, dependency-review gate, service accounts, and runner maintenance.