Phase A is live on koala k3s (manifests in mathias/infrak3s/apps/cad-atlas/, Flux-reconciled), but the first deploy was GitOps-direct (manifests committed by hand). The CI deploy job in .gitea/workflows/cd.yml clones infra over SSH and bumps the image tag — it requires an INFRA_DEPLOY_KEY Actions secret (SSH private key with push access to mathias/infra). That secret is not set, so:
The deploy job now reds on every push to main (guard bug fixed in commit 68adfe7 / template-go-web#9, so the job actually runs now). check + build are green; deploy fails on the missing key.
Done when
Generate an SSH keypair for cad-atlas CI → infra.
Register the public key as a write deploy key on mathias/infra (mirror how cobalt-dingo's CI is wired).
Add the private key as the INFRA_DEPLOY_KEY Actions secret on cad-atlas (secret-write — needs explicit go).
Verify: a push to main → deploy job bumps k3s/apps/cad-atlas/deployment.yaml image tag → Flux rolls the new image.
Risk: LOW-MEDIUM (grants CI push to infra — scope the deploy key to the single repo). Until done, deploy stays manual/GitOps-direct.
## Context
Phase A is live on koala k3s (manifests in `mathias/infra` `k3s/apps/cad-atlas/`, Flux-reconciled), but the **first deploy was GitOps-direct** (manifests committed by hand). The CI `deploy` job in `.gitea/workflows/cd.yml` clones `infra` over SSH and bumps the image tag — it requires an `INFRA_DEPLOY_KEY` Actions secret (SSH private key with push access to `mathias/infra`). That secret is **not set**, so:
- The `deploy` job now **reds on every push to main** (guard bug fixed in commit 68adfe7 / template-go-web#9, so the job actually runs now). `check` + `build` are green; `deploy` fails on the missing key.
## Done when
- [ ] Generate an SSH keypair for cad-atlas CI → infra.
- [ ] Register the **public** key as a write **deploy key** on `mathias/infra` (mirror how cobalt-dingo's CI is wired).
- [ ] Add the **private** key as the `INFRA_DEPLOY_KEY` Actions secret on `cad-atlas` (secret-write — needs explicit go).
- [ ] Verify: a push to main → `deploy` job bumps `k3s/apps/cad-atlas/deployment.yaml` image tag → Flux rolls the new image.
Risk: LOW-MEDIUM (grants CI push to infra — scope the deploy key to the single repo). Until done, deploy stays manual/GitOps-direct.
Done — CI auto-deploy wired and verified end-to-end
Generated a dedicated ed25519 keypair for cad-atlas CI.
Public key registered as a write deploy-key (cad-atlas-ci) on mathias/infra (Gitea API, 201).
Private key stored as the INFRA_DEPLOY_KEY Actions secret on cad-atlas (201). Private key never left the koala subprocess; scrubbed after.
Verified: pushed c3fda9b → run 23 success (check + build + deploy) → deploy job pushed the image-tag bump to infra → Flux rolled the pod to cad-atlas:c3fda9b in ~60s. No manual GitOps step.
Note: the deploy-key grants cad-atlas CI write to the whole infra repo (Gitea deploy keys aren't path-scoped) — same trust model as cobalt-dingo's CI. Closing.
## Done — CI auto-deploy wired and verified end-to-end
- Generated a dedicated ed25519 keypair for cad-atlas CI.
- Public key registered as a **write deploy-key** (`cad-atlas-ci`) on `mathias/infra` (Gitea API, 201).
- Private key stored as the `INFRA_DEPLOY_KEY` Actions secret on `cad-atlas` (201). Private key never left the koala subprocess; scrubbed after.
**Verified:** pushed `c3fda9b` → run 23 **success** (check + build + **deploy**) → deploy job pushed the image-tag bump to `infra` → Flux rolled the pod to `cad-atlas:c3fda9b` in ~60s. No manual GitOps step.
Note: the deploy-key grants cad-atlas CI write to the whole `infra` repo (Gitea deploy keys aren't path-scoped) — same trust model as cobalt-dingo's CI. Closing.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Context
Phase A is live on koala k3s (manifests in
mathias/infrak3s/apps/cad-atlas/, Flux-reconciled), but the first deploy was GitOps-direct (manifests committed by hand). The CIdeployjob in.gitea/workflows/cd.ymlclonesinfraover SSH and bumps the image tag — it requires anINFRA_DEPLOY_KEYActions secret (SSH private key with push access tomathias/infra). That secret is not set, so:deployjob now reds on every push to main (guard bug fixed in commit68adfe7/ template-go-web#9, so the job actually runs now).check+buildare green;deployfails on the missing key.Done when
mathias/infra(mirror how cobalt-dingo's CI is wired).INFRA_DEPLOY_KEYActions secret oncad-atlas(secret-write — needs explicit go).deployjob bumpsk3s/apps/cad-atlas/deployment.yamlimage tag → Flux rolls the new image.Risk: LOW-MEDIUM (grants CI push to infra — scope the deploy key to the single repo). Until done, deploy stays manual/GitOps-direct.
Done — CI auto-deploy wired and verified end-to-end
cad-atlas-ci) onmathias/infra(Gitea API, 201).INFRA_DEPLOY_KEYActions secret oncad-atlas(201). Private key never left the koala subprocess; scrubbed after.Verified: pushed
c3fda9b→ run 23 success (check + build + deploy) → deploy job pushed the image-tag bump toinfra→ Flux rolled the pod tocad-atlas:c3fda9bin ~60s. No manual GitOps step.Note: the deploy-key grants cad-atlas CI write to the whole
infrarepo (Gitea deploy keys aren't path-scoped) — same trust model as cobalt-dingo's CI. Closing.