feat(terraform): Forgejo Stage 0 — R2 buckets + Tailscale tag + Tunnel ingress#43
Merged
Conversation
Replace misleading '上位ルーター' comments with explicit device names (ISP router/Buffalo/ICX) and add network-architecture.md documenting the full topology, routing design, and Buffalo SPI root cause/fix.
Contributor
✅ Plan succeededOpenTofu outputComment |
Contributor
✅ Dry-run passedAnsible outputComment |
Owner
Author
|
/tf-apply |
Contributor
❌ Apply failedOpenTofu output |
Stage 0 of Forgejo + Woodpecker CI on Talos K8s. - R2: two bucket-scoped tokens (forgejo-backup, longhorn-backup) for CNPG barmanObjectStore and Longhorn BackupTarget. Tokens use the Workers R2 Storage Bucket Item Read/Write permission groups with a resource selector pinning each token to a single bucket. - Outputs (sensitive): r2_account_id, r2_endpoint_url, and per-bucket access_key_id (= token ID) / secret_access_key (= sha256(token.value)). Consumed via 'tofu output -raw <name>' into SOPS-encrypted K8s Secrets. - Tailscale: add tag:forgejo (owner tag:k8s-operator), plus the same deny rule pattern used for tag:nextcloud, and grant admin -> tag:forgejo on tcp:22/443 for SSH + Web UI access. - Cloudflare Tunnel: add forgejo.turtton.net -> forgejo-http.forgejo cluster service. NOT added to access_protected_hostnames; Forgejo enforces its own auth (local + admin 2FA + self-registration disabled).
turtton
force-pushed
the
feat/forgejo-woodpecker-plan
branch
from
4984330 to
79e3167
Compare
Owner
Author
|
/tf-apply |
5 similar comments
Owner
Author
|
/tf-apply |
Owner
Author
|
/tf-apply |
Owner
Author
|
/tf-apply |
Owner
Author
|
/tf-apply |
Owner
Author
|
/tf-apply |
cloudflare_api_token uses legacy /user/tokens endpoint which requires
user-level auth unavailable with account-scoped tokens. Switch to
cloudflare_account_token which uses /accounts/{id}/tokens endpoint.
Also imports existing R2 buckets into state after provider upgrade.
This was referenced May 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stage 0 of the Forgejo + Woodpecker CI plan (see `.sisyphus/plans/forgejo-actions.md` Rev. 9).
This PR delivers the infrastructure prerequisites that must exist before any Stage 1/2/3 K8s manifests are applied:
Plan summary
```
Plan: 5 to add, 2 to change, 0 to destroy.
```
Outputs added (all sensitive except the first two):
Access key = `cloudflare_api_token..id`. Secret = `sha256(token.value)` (Cloudflare R2 S3 API convention).
Next steps (after merge)
Verification