# CI/CD Setup — Using Homelab SOPS-Managed REGISTRY_PAT

## 🔐 Secret Management

The `REGISTRY_PAT` token is now encrypted and managed via **SOPS/ksops** in the homelab repository.

**Location**: `~/workplace/homelab/k8s/argocd/secrets/forgejo-registry-pat.enc.yaml`

**Status**: ✅ Deployed to K8s cluster (forgejo namespace)

---

## Setup (5 minutes)

### Step 1: Add Secret to Repository Actions (Web UI)

Go to: **https://git.riotpiao.com/rock/poimen-memory/settings/secrets**

Add secret:
- **Name**: `REGISTRY_PAT`
- **Value**: `bdf6a1d2317c28a332447083c61bb463d24defb7`

(This value is also encrypted in homelab — see `forgejo-registry-pat.enc.yaml`)

### Step 2: Trigger Build

```bash
cd ~/workplace/Poimen/memory
git commit --allow-empty -m "Trigger CI with REGISTRY_PAT"
git push origin main
```

### Step 3: Monitor

```bash
# Watch workflow
https://git.riotpiao.com/rock/poimen-memory/actions

# Watch deployment
kubectl get pods -n poimen -l app.kubernetes.io/name=poimen-memory -w
```

---

## How It Works

```
Git Push
    ↓
Forgejo Actions CI
    ↓
Uses REGISTRY_PAT secret
    ↓
docker login → build → push to forgejo.riotpiao.com
    ↓
ArgoCD watches and deploys
```

---

## For All Poimen Repos

**Same process**:
1. Add `REGISTRY_PAT` secret to each repo's Actions settings
2. Copy `.forgejo/workflows/build.yaml` from poimen-memory
3. Push and CI runs automatically

The PAT is centrally managed in homelab (encrypted with SOPS), so if it needs rotation:
- Update only once in homelab
- Re-encrypt with SOPS
- All repos using the same token automatically work

---

## Homelab Integration

**Encrypted in**: `~/workplace/homelab/k8s/argocd/secrets/forgejo-registry-pat.enc.yaml`

**Managed by**: ksops in `k8s/argocd/secrets/secret-generator.yaml`

**Deployed as**: K8s Secret `forgejo-registry-pat` in `forgejo` namespace

**Accessible in cluster**:
```bash
kubectl get secret -n forgejo forgejo-registry-pat
kubectl get secret -n forgejo forgejo-registry-pat -o jsonpath='{.data.REGISTRY_PAT}' | base64 -d
```

---

## Security

- ✅ Token encrypted with SOPS (age encryption)
- ✅ Never committed in plaintext
- ✅ Centrally managed (single source of truth)
- ✅ Can be rotated in one place (homelab)
- ✅ Audit trail in git commits
- ✅ Requires age private key to decrypt (access controlled)