jakman85andClaude Opus 5.5
b855b6b294
Gitea stays public on the Cloudflare Tunnel, but anonymous crawlers have kept the pod at 2-6 cores since PR #156. Operator decision 2026-11-14: reading anything requires a (Keycloak) login. - catalog/gitea.yaml (+ re-rendered apps/wave-0/gitea.yaml): GITEA__service__REQUIRE_SIGNIN_VIEW=true (strict: web, API, git pull, registry /v2/token), and a postStart-written robots.txt (Disallow: /). - clusters/prod: flux-system GitRepository gets secretRef flux-gitea-read, an OUT-OF-BAND read:repository token the operator must create BEFORE merge. - gate.yml / cve-triage.yaml: the toolbox job image was pulled anonymously from the Gitea registry; it now uses container.credentials with the existing RENOVATE_TOKEN (read:package, proven by renovate.yaml preflight). Anonymous-reader inventory and operator steps: decisions/2026-11-14-gitea-require-signin.md Co-Authored-By: Claude Opus 5.5 <[email protected]>
apps
App-tier manifests, rendered from catalog/*.yaml ServiceDefinitions by catalog/render.py
and split into dependency-ordered waves (wave-<N>/).
- Each
wave-<N>/is reconciled by its own Flux Kustomizationapps-wave-<N>(clusters/base/apps-wave-<N>.yaml), whichdependsOnwave N-1 (wave 0 dependsOnplatform-config) and health-gates (wait: true) ONLY that wave. A crashlooping workload in a later wave can no longer stall an earlier wave or block new revisions. wave-<N>/kustomization.yamlandclusters/base/apps-wave-<N>.yamlare generated — runpython3 catalog/render.py --emit-wavesafter onboarding a service; do not hand-edit them.- Wave assignment = longest dependency-path depth over the catalog
dependencies:graph; a co-located CNPG database<svc>-dbis a leaf and always lands strictly below its consumer.
See ../DESIGN-waves.md for the wave table, Flux topology, and the
cutover runbook.