head
-
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy header, project descriptions and a linked documentation directory. Omit the repeated page title and generated language heading. Remove the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct GitHub Pages DNS records. Preserve repeated publication when pages is the remote default branch, and include Rules ISO in the main documentation. Document site onboarding in a registered, validated skill. Keep AL introduction short with useful links and preserve its lifecycle details in a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and Chrome inputs, sandboxed export actions, an update target and freshness checks, and include the maintained diagrams in infra/arch documentation. Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests, diagram repeatability and freshness, DNS configuration, Terraform formatting, semantic lint and repository quality.
Goal-Ref: build-and-deploy-every-project-landing-page-a782b800 Attempt-ID: attempt-00941092c164
LLM-disclaimer: This commit was generated by an LLM.
-
Wait for AL secret cleanup and plugin shutdown
Roll back partial plugin startup, drain requests before releasing resources, and wait for plugin and command processes to exit. Stop independent plugins concurrently while preserving dependency order inside each plugin.
Revoke invocation-owned credentials, remove temporary secret files, and verify Forgejo and Harbor session cleanup. Preserve the user’s existing Vault login. Enforce Vault OIDC origins and no_auth, redact sensitive errors, and restrict config dumps to owner-only files. Add the AppRole SecretID cleanup permission.
Cover normal exit, cancellation, failed startup, credential revocation, and transport cleanup with synthetic unit and real command/plugin regression tests.
Clarify that required formatting-only repairs need no separate approval, and fix the existing blank-line formatting failure in the GitHub AL wrapper.
Goal-Ref: fix-al-secret-lifecycle-and-plugin-shutdown-3137c0b0 Attempt-ID: attempt-0c1353676e2f
LLM-disclaimer: This commit was generated by an LLM.
-
Extract DNSControl setup into rules_dnscontrol
Extract the DNSControl setup into
rules_dnscontrol, generate its Bazel dependency bundle from project-owned record files, and update the DNS guidance. Move Hugo rules and the worker to role-based package paths, and give each non-nested project a locally owned Hugo landing target that reuses the shared README-to-landing macro.Clean all landing and Pages DNS records so GitHub Pages serves each project subdomain directly without Cloudflare proxying. Improve the main site with a three-panel home layout, complete project links, documentation explore links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with the nested
rules_hugotests, Buildifier, and repository quality checks.LLM-disclaimer: This commit was generated by an LLM.
-
Add standalone documentation rules
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
This commit was generated by an LLM.
- Set up Split Horizon DNS, refactor IDM a bit
- Add //third_party/org_fedora_cloud, fix alwaldend.com roles
- Set up unikernel deploy
- Add signing policy to vault_pki_server
- Update cluster token ttl, update secrets
- Add sops, add vault_transit_key, add sops to fluxcd
- Add k3s_auth configs
- Add admin group for the flux cluster
- Use a custom traefik deploy instead of the bundled one
- Deploy ClusterIssuer for cert-manager
- Rewrite k3s role, finish flux deploy
- Add optional disk mount to traefik and forgejo, add ceph disks to forgejo VMs
- Enable asyncio=native, iothread, emulatessd, discard, add ceph disk support
- Disable firewalld in firewall role
- Move gateway into pve_vm_qemu
- Move pve to //infra/pve, remove //infra/dc1
- Remove consul IaC
- Add harbor_login, add harbor IaC, fix bazel’s certificates
- Add drawio-desktop, add //infra/arch, update opencode restrictions
- Finish the forgejo role
- Finish the traefik role
- Add fp modules, refactor tf backend to use it, add parallel start of plugins, add lock check to the backend
- Improve consul deploy, improve vault approles
- Migrate proxmox resource to separate resource pools, add a vm module
- Create folders and resource pools from approle config instead of duplication
- Set up automated PVE login using OIDC, remove PVE tokens
- Fix pve firewall, add //infra/dc1/consul1, standardize ssh and pki roles
- Add timezone management to the host role and TrustedUserCAKeys to the ssh role
- Set up OIDC with Vault as provider
- Set up ACME, disable mTLS for Vault
- Automate root token generation, split the main vault policy into separate ones
- Move vault tools to //tools/vault, replace go_binary in al_binary with native_binary
- Fix cert auth entities, reformat all tf files
- Set up client certificate generation, move ica to a separate module
- Add backup_bucket module, add rclone, set up backups for Vault
- Migrate all resources to separate terraform-managed cloud folders
- Add yc_folder terraform module, migrate to it
- Migrate Vault to Raft storage, start setting up backups, add postgresql role
- Migrate some docs target to the new macro
- Write a proper runner for terraform and vault, set up s3 backends for terraform
- Refactor approle management into a terraform module
- Initial commit
-
Add spellcheck skill
This commit was generated by an LLM.