100 lines
2.3 KiB
Markdown
100 lines
2.3 KiB
Markdown
|
# CI/CD Setup — Using Homelab SOPS-Managed REGISTRY_PAT
|
||
|
|
|
||
|
|
## 🔐 Secret Management
|
||
|
|
|
||
|
|
The `REGISTRY_PAT` token is now encrypted and managed via **SOPS/ksops** in the homelab repository.
|
||
|
|
|
||
|
|
**Location**: `~/workplace/homelab/k8s/argocd/secrets/forgejo-registry-pat.enc.yaml`
|
||
|
|
|
||
|
|
**Status**: ✅ Deployed to K8s cluster (forgejo namespace)
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Setup (5 minutes)
|
||
|
|
|
||
|
|
### Step 1: Add Secret to Repository Actions (Web UI)
|
||
|
|
|
||
|
|
Go to: **https://git.riotpiao.com/rock/poimen-memory/settings/secrets**
|
||
|
|
|
||
|
|
Add secret:
|
||
|
|
- **Name**: `REGISTRY_PAT`
|
||
|
|
- **Value**: `bdf6a1d2317c28a332447083c61bb463d24defb7`
|
||
|
|
|
||
|
|
(This value is also encrypted in homelab — see `forgejo-registry-pat.enc.yaml`)
|
||
|
|
|
||
|
|
### Step 2: Trigger Build
|
||
|
|
|
||
|
|
```bash
|
||
|
|
cd ~/workplace/Poimen/memory
|
||
|
|
git commit --allow-empty -m "Trigger CI with REGISTRY_PAT"
|
||
|
|
git push origin main
|
||
|
|
```
|
||
|
|
|
||
|
|
### Step 3: Monitor
|
||
|
|
|
||
|
|
```bash
|
||
|
|
# Watch workflow
|
||
|
|
https://git.riotpiao.com/rock/poimen-memory/actions
|
||
|
|
|
||
|
|
# Watch deployment
|
||
|
|
kubectl get pods -n poimen -l app.kubernetes.io/name=poimen-memory -w
|
||
|
|
```
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## How It Works
|
||
|
|
|
||
|
|
```
|
||
|
|
Git Push
|
||
|
|
↓
|
||
|
|
Forgejo Actions CI
|
||
|
|
↓
|
||
|
|
Uses REGISTRY_PAT secret
|
||
|
|
↓
|
||
|
|
docker login → build → push to forgejo.riotpiao.com
|
||
|
|
↓
|
||
|
|
ArgoCD watches and deploys
|
||
|
|
```
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## For All Poimen Repos
|
||
|
|
|
||
|
|
**Same process**:
|
||
|
|
1. Add `REGISTRY_PAT` secret to each repo's Actions settings
|
||
|
|
2. Copy `.forgejo/workflows/build.yaml` from poimen-memory
|
||
|
|
3. Push and CI runs automatically
|
||
|
|
|
||
|
|
The PAT is centrally managed in homelab (encrypted with SOPS), so if it needs rotation:
|
||
|
|
- Update only once in homelab
|
||
|
|
- Re-encrypt with SOPS
|
||
|
|
- All repos using the same token automatically work
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Homelab Integration
|
||
|
|
|
||
|
|
**Encrypted in**: `~/workplace/homelab/k8s/argocd/secrets/forgejo-registry-pat.enc.yaml`
|
||
|
|
|
||
|
|
**Managed by**: ksops in `k8s/argocd/secrets/secret-generator.yaml`
|
||
|
|
|
||
|
|
**Deployed as**: K8s Secret `forgejo-registry-pat` in `forgejo` namespace
|
||
|
|
|
||
|
|
**Accessible in cluster**:
|
||
|
|
```bash
|
||
|
|
kubectl get secret -n forgejo forgejo-registry-pat
|
||
|
|
kubectl get secret -n forgejo forgejo-registry-pat -o jsonpath='{.data.REGISTRY_PAT}' | base64 -d
|
||
|
|
```
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Security
|
||
|
|
|
||
|
|
- ✅ Token encrypted with SOPS (age encryption)
|
||
|
|
- ✅ Never committed in plaintext
|
||
|
|
- ✅ Centrally managed (single source of truth)
|
||
|
|
- ✅ Can be rotated in one place (homelab)
|
||
|
|
- ✅ Audit trail in git commits
|
||
|
|
- ✅ Requires age private key to decrypt (access controlled)
|
||
|
|
|